WAN Acceleration Security Best Practices

Copyright © February 2005 Brintech Inc. All rights reserved.

Wireless WAN Security Taming the Hostile Air By Dan MacDonald, Brintech Senior Security Analyst Banks have an ever-increasing need for Wide Area Network (WAN) services to transfer
information among their central locations, branches, and remote facilities. Until recently,
banks have been limited to hiring telephone companies that use existing wired
infrastructure to support these network communications. Wired infrastructure is
expensive for telephone companies to install and maintain, which in turn can create a
hefty price tag for the high-speed data transfer capabilities that an increasing number of
banking applications require. Today, wireless technologies are available that allow for relatively high-
speed data transfers at a lower cost. This family of technologies utilizes
radio waves or laser beams for data transmission. Although the
transmission of data directly through the air is inexpensive and convenient,
the resulting lack of control over the transmission path also leaves the data
potentially vulnerable to access and interception. As a result, these so-called
longhaul wireless networks must be treated with caution from a security
standpoint, and they may be unsuitable for highly sensitive applications. Wireless Technology Basics All wireless technologies suitable for longhaul usage employ one of two
transmission media: radio waves or lasers. Radio-transmitted systems
transmit via radio waves or microwaves; laser-transmitted systems utilize
a laser beam over open air. The important difference for banking applications is that laser systems have
a tighter beam spread. This characteristic helps limit the over-transmission
of signals, which has implications for data security. Wireless systems may be licensed or unlicensed. Unlicensed
systems have restricted power outputs, share frequencies with other
unlicensed systems, and are generally forced to accept any
interference that falls within their frequency range. These
characteristics potentially limit the range and reliability of the
wireless devices. However, the user saves the expense and time of Wireless WAN Security 2 124 Canal Street • New Smyrna Beach, FL 32168 • p 800. 929.2746 • f 386.427.2895 • www.Brintech.com obtaining a license from the Federal Communications Commission (FCC).
Common protocols for unlicensed systems with more restrictive ranges are
802.11a, 802.11b, and 802.11g, but unlicensed microwave solutions are also
available. Licensed systems, in contrast, are allowed to transmit at higher output (up to the power
stated on the license) and have a dedicated frequency on which they operate. These
advantages allow for greater range and reliability. However, the user must factor in the
expense and difficulty of obtaining an FCC license. Security Considerations Banks that consider converting to wireless data transmission have compelling reasons to
carefully manage the attendant security issues. Besides critical business reasons for
safeguarding the integrity of the information transmitted over a wireless network, banks are
subject to federal information privacy standards. For example, banks are required to apply
technical, administrative, and physical safeguards to the handling and transmission of bank
and customer information. The following points summarize a number of security issues that
banks should explore in connection with implementing a wireless system. Public Information Disclosure Applications for licensed wireless frequencies are public information. Consequently, banks
should provide only information suitable for public disclosure in the application. To ensure
a degree of confidentiality, applicants should use generic phone numbers and contact
information in the application wherever possible and allowed by the FCC. In addition, the FCC makes licensee information readily available to the public at its website
(www.fcc.gov). Publicly disclosed information includes frequencies, power ratings, and
location installation details. These disclosures make it essential for banks to implement
appropriate information security precautions (including physical security measures) during
the application and operational phases of implementing wireless technology. Signal Direction and Calibration To help control access to the signal, banks should ensure that their
wireless networks utilize unidirectional equipment. Such equipment
sends the signal in one tight group rather than broadcasting it in all
directions around the transmitter. A unidirectional signal helps limit the
sources of potential interception to a smaller physical area, generally Wireless WAN Security 3 124 Canal Street • New Smyrna Beach, FL 32168 • p 800. 929.2746 • f 386.427.2895 • www.Brintech.com along the line running between the antenna stations. (See Figure 1.) Figure 1: Omnidirectional and Unidirectional Signals
Laser systems are by their nature unidirectional. Licensed and unlicensed microwave
systems are also often unidirectional. Systems that use the 802.11[a,b,g] protocols are by
nature omnidirectional, but the signal direction can be altered and controlled with
unidirectional antennae. (See Figure 2.) Figure 2: Unidirectional Antenna A unidirectional antenna will help control the airspace of the signal;
however, a significant amount of signal may still pass the receiving
antenna (“over-transmissions”), since the signal may still have significant
spread over distance. Also be aware that readily available special antenna equipment and/or amplifying equipment are capable of intercepting extraneous signal
outside of the usable beam spread and at much greater distances than expected from the
source. This signal phenomenon is especially true of the 802.11[a,b,g] family of technologies. While anyone can purchase equipment that intercepts wireless signals, some technologies
require legwork to locate. However, equipment for 802.11[a,b,g] signals, like those
unidirectional antennae discussed above, is a commodity item, readily and cheaply
available at most electronics or computer stores. Transmitters should be tightly calibrated and locked against slippage. A certain amount of
extraneous signal almost always passes the antenna stations. Proper calibration will help
reduce the strength and range of over-transmissions. Signal Strength A clear line of sight between the antenna stations helps improve signal
strength as well as reduce unauthorized access to the signal beam. Radio
signals have a certain ability to penetrate obstructions, but this ability Omni-directional Uni-directional Antenna Wireless WAN Security 4 124 Canal Street • New Smyrna Beach, FL 32168 • p 800. 929.2746 • f 386.427.2895 • www.Brintech.com often comes at the price of significant signal loss. The proximity of buildings,
trees, and other nearby objects may make interception of the signal stream easier
and less obvious to your monitoring equipment. Therefore, consider the
potential for unauthorized access to the signal from an intermediate structure,
even if the signal does not directly penetrate it. (See Figure 3.) Figure 3: Intermediate Structure with Unauthorized Signal Access Encryption Generally speaking, financial institutions should consider wireless links as hostile networks.
As a result, banks should apply security measures similar to those used for Internet links. In
fact, when a wireless system transports internal network traffic, the emphasis on security
should be even stronger. The policy governing financial institution wireless systems should require robust encryption
standards. For banking applications, the Advanced Encryption Standard (AES) is
recommended over Triple Data Encryption Standard (3DES), since the former performs
better and has stronger encryption features. Under no circumstances should a wireless
application use Data Encryption Standard (DES). DES becomes more unsuitable every day
as a result of the increasing availability of computer hardware capable of recovering DES
keys in short timeframes. Depending on the equipment used in a wireless system, financial institutions can implement
encryption on the transmitter/receiver, at the point of any firewalls, or by using an
additional encryption or Virtual Private Network (VPN) device. Keep in mind that
performance may suffer when encryption is enabled on the transmitter/receiver units. Encryption configuration should prevent network topology information
(such as internal Internet Protocol (IP) addresses or routing
information) from unencrypted transmission over the wireless link. In
addition, to achieve a greater degree of security, financial institutions
should employ frequent key rotation. Antenna Antenna Wireless WAN Security 5 124 Canal Street • New Smyrna Beach, FL 32168 • p 800. 929.2746 • f 386.427.2895 • www.Brintech.com Financial institutions should remember that the Wired Equivalent Privacy (WEP)
technology provided with the 802.11 [a,b,g] family of protocols is not sufficient
for banking industry wireless applications. Readily available software tools (such
as AirSnort and Kismet) can quickly capture enough traffic to exploit a weakness
in the protocol, enabling key recovery in as little as three hours on a busy wireless link. Wi-fi Protected Access (WPA) is an improvement, but is still best combined
with other encryption technologies. Routers A financial institution’s wireless system should use appropriate limiting controls on the
endpoint routers to filter unnecessary or unwanted traffic from the links. Banks may also
consider implementing a firewall, depending on the traffic flows and configuration. Because wireless devices are designed to be bridged technology, installing routers to control
the traffic at the network layer is advisable, both for performance and security reasons.
Without network layer control, it is more difficult to control the flow of traffic over the link.
Some firewalls may serve the purpose of a router in these configurations. Physical Controls Financial institutions should also consider the need for appropriate physical controls over
the wireless system. Most wireless systems suitable for longhaul applications have an
antenna that is separate from the transmitter/receiver unit. This separation allows
placement of the antenna on the rooftop or otherwise outside the building. Under no
circumstances should a network connection be installed away from the bank’s physical
premises, although sometimes shared-tenancy buildings necessitate antenna cable
installation through common access spaces. Banks should ensure that physical controls are
appropriate for such a situation, and even then, no cabling or part of the infrastructure
should be readily available to the public. Financial institutions should also make sure that all components of the wireless system are
secured by appropriate physical controls. To guard the antenna, rooftop access should be
limited. Connections outside the building should be secured to the extent possible through
lockable enclosures and tamper-preventing measures such as
weatherproofing sealants or tamper tape. As is true of any other
network device, the transmitter/receiver and any routers or firewalls
should be located within locked facilities. Wireless WAN Security 6 124 Canal Street • New Smyrna Beach, FL 32168 • p 800. 929.2746 • f 386.427.2895 • www.Brintech.com Monitoring and Maintenance Following installation of a wireless system for transmitting bank data, careful
monitoring is a must. Banks should implement procedures that monitor traffic
and signal conditions to watch for signs of signal interception. Such warning signs include packet loss, increased usage, temporary carrier loss, or weakened signal
strength. Banks should also employ properly managed Intrusion Detection Systems (IDS) designed
around detection of malicious traffic over the wireless link. Finally, to receive timely
notification of security issues and software updates, banks should subscribe to notification
mailing lists for all equipment deployed as components of the wireless system. A Wireless Longhaul Scenario A reasonably secured wireless longhaul implementation could logically look something like
Figure 4. Figure 4: A Wireless Longhaul Scenario Note the IDS sensor on the main network outside the firewall. This sensor will be most
effective only if the traffic is unencrypted when it passes the sensor. If data passing the IDS
sensor has already been encrypted (as would be the case if encryption were implemented at
the firewall below), the IDS sensor would have very limited effectiveness because the IDS
cannot see into the encrypted data flow. IDS sensor placement, in this case, is like IDS
placement in any other application; that is, the placement and effectiveness of the sensor
will vary based on the goals of the organization. Again, the antennae should be positioned to allow as little physical
access to the signal airspace as possible from anywhere in between the
antennae. All devices should be located in physically secured spaces,
such as data centers or locked wiring closets. Because the antenna
generally requires location outside of the building, it may require looser AES Encrypted Traffic Antenna Antenna Firewall/ Router Wireless Transmitter/receiver w/ integrated AES Wireless Transmitter/receiver w/ integrated AES Firewall/ Router Branch Network Main Network IDS Sensor Wireless WAN Security 7 124 Canal Street • New Smyrna Beach, FL 32168 • p 800. 929.2746 • f 386.427.2895 • www.Brintech.com physical access controls. However, the antenna still should be secured to the
extent possible. The Bottom Line Security issues should figure heavily when a bank decides to implement a wireless system
to transmit bank data. Security controls that are appropriate for wireless banking
applications should be built into wireless implementations and constantly monitored for
weaknesses or breaches. Improper controls could introduce a serious weakness into a bank’s
data security posture. With appropriate controls in place, a longhaul wireless system could
be a safe and cost-effective solution to a bank’s ever-growing data transmissions. For more information about wireless security, contact Sean Clark, Brintech’s Information
Security Practice Manager, at 800.929.2746 or via e-mail ClientService@Brintech.com. Brintech is a Consulting firm dedicated to the financial services industry. Brintech's consultants are senior bankers who are experts in their specialties…Process Improvement, Risk Management, Strategic Planning, Profit Enhancement, Branching and Market Analysis .At the same time, Brintech's Technology Professionals have helped more than 600 financial institutions with Technology Planning, Vendor Selection, Networking, System Security and more. Brintech…bringing strategy and technology together to improve performance

Comments