Related Knowledge

Most Viewed Knowledge


Wireless WAN Security

WP 08.24.2010

By: Dan MacDonald

Banks have an ever-increasing need for Wide Area Network (WAN) services to transfer information among their central locations, branches, and remote facilities. Until recently, banks have been limited to hiring telephone companies that use existing wired infrastructure to support these network communications. Wired infrastructure is expensive for telephone companies to install and maintain, which in turn can create a hefty price tag for the high-speed data transfer capabilities that an increasing number of banking applications require.

Today, wireless technologies are available that allow for relatively high-speed data transfers at a lower cost. This family of technologies utilizes radio waves or laser beams for data transmission. Although the transmission of data directly through the air is inexpensive and convenient, the resulting lack of control over the transmission path also leaves the data potentially vulnerable to access and interception. As a result, these so-called long-haul wireless networks must be treated with caution from a security standpoint, and they may be entirely unsuitable for highly sensitive applications.

Wireless Technology Basics

All wireless technologies suitable for long-haul usage employ one of two transmission media: radio waves or lasers. Radio-transmitted systems transmit via radio waves or microwaves; laser-transmitted systems utilize a laser beam over open air.

The important difference for banking applications is that laser systems have a tighter beam spread. This characteristic helps limit the over-transmission of signals, which has implications for data security. Wireless systems may be licensed or unlicensed. Unlicensed systems have restricted power outputs, share frequencies with other unlicensed systems, and are generally forced to accept any interference that falls within their frequency range. These characteristics potentially limit the range and reliability of the wireless devices. However, the user saves the expense and time of obtaining a license from the Federal Communications Commission (FCC). Common protocols for unlicensed systems with more restrictive ranges are 802.11a, 802.11b, and 802.11g, but unlicensed microwave solutions are also available.

Licensed systems, in contrast, are allowed to transmit at higher output (up to the power stated on the license) and have a dedicated frequency on which they operate. These advantages allow for greater range and reliability. However, the user must factor in the expense and difficulty of obtaining an FCC license.

Security Basics

Banks that consider converting to wireless data transmission have compelling reasons to carefully manage the attendant security issues. Besides critical business reasons for safeguarding the integrity of the information transmitted over a wireless network, banks are subject to federal information privacy standards. For example, banks are required to apply technical, administrative, and physical safeguards to the handling and transmission of bank and customer information. The following points summarize a number of security issues that banks should explore in connection with implementing a wireless system.

Public Information Disclosure. Applications for licensed wireless frequencies are public information. Consequently, banks should provide only information suitable for public disclosure in the application. To ensure a degree of confidentiality, applicants should use generic phone numbers and contact information in the application wherever possible and allowed by the FCC.

In addition, the FCC makes licensee information readily available to the public at its website (http://www.fcc.gov). Publicly disclosed information includes frequencies, power ratings, and location installation details. These disclosures make it essential for banks to implement appropriate information security precautions (including physical security measures) during the implementation of wireless technology.

Signal Direction and Calibration. To help control access to the signal, banks should ensure that their wireless networks utilize unidirectional equipment. Such equipment sends the signal in one tight group rather than broadcasting it in all directions around the transmitter. A unidirectional signal helps limit the sources of potential interception to a smaller physical area, generally along the line running between the antenna stations. Laser systems are by their nature unidirectional. Licensed and unlicensed microwave systems are also often unidirectional. Systems that use the 802.11[a,b,g] protocols are by nature omnidirectional, but the signal direction can be altered and controlled with unidirectional antennae.

Check to be sure that extraneous signals passing the antenna (“over-transmissions” of signal) are controlled with a unidirectional antenna because the signal may still have significant spread over distance. Also be aware that readily available special antenna equipment and/or amplifying equipment are capable of intercepting extraneous signal outside of the usable beam spread and at much greater distances than expected from the source. This signal phenomenon is especially true of the 802.11[a,b,g] family of technologies.

Also, while equipment suitable for intercepting wireless signals of all forms is available to anyone who wishes to purchase it, some technologies require legwork to locate. However, equipment for 802.11[a,b,g] signals is a commodity item, readily and cheaply available at most electronics or computer stores.

Transmitters should be tightly calibrated and locked against slippage. A certain amount of extraneous signal almost always passes the antenna stations. Proper calibration will help reduce the strength and range of over-transmissions.

Signal Strength. A clear line of sight between the antenna stations helps improve signal strength as well as reduce unauthorized access to the signal beam. Radio signals have a certain ability to penetrate obstructions, but this ability often comes at the price of significant signal loss. The proximity of buildings, trees, and other nearby objects may make interception of the signal stream easier and less obvious to your monitoring equipment. Therefore, consider the potential for unauthorized access to the signal from an intermediate structure, even if the signal does not directly penetrate it.

Encryption. In general, a wireless link should be considered a hostile network. As a result, it is appropriate to apply security measures that are similar to those used for Internet links. In fact, when a wireless system transports internal network traffic, the emphasis on security should be even stronger.

The policy governing your wireless system should require the use of robust encryption standards. For banking applications, the Advanced Encryption Standard (AES) is recommended over Triple Data Encryption Standard (3DES) because it has better performance and stronger encryption features. Under no circumstances should a wireless application use Data Encryption Standard (DES). DES becomes more unsuitable every day as a result of the increasing availability of computer hardware capable of recovering DES keys in short timeframes.

Depending on the equipment used in a given wireless system, encryption may be implemented on the transmitter/receiver, at the point of any firewalls, or by using an additional encryption or Virtual Private Network (VPN) device. Keep in mind that performance may suffer when encryption is enabled on the transmitter/receiver units.

Encryption configuration should prevent network topology information (such as internal Internet Protocol (IP) addresses or routing information) from unencrypted transmission over the wireless link. In addition, to achieve a greater degree of security, employ frequent key rotation.

Be aware that the Wired Equivalent Privacy (WEP) technology provided with the 802.11 [a,b,g] family of protocols is not sufficient for banking industry wireless applications. Readily available software tools (such as AirSnort and Kismet) can quickly capture enough traffic to exploit a weakness in the protocol, enabling key recovery in as little as three hours on a busy wireless link. Wi-fi Protected Access (WPA) is an improvement but is still best combined with other encryption technologies.

Routers. Your wireless system should use appropriate limiting controls on the endpoint routers to filter unnecessary or unwanted traffic from the links. Also consider implementation of a firewall, depending on the traffic flows and configuration.

Because wireless devices are designed to be bridged technology, installation of routers to control the traffic at the network layer is advisable, both for performance and security reasons. Without network layer control, it is more difficult to control the flow of traffic over the link. Some firewalls may serve the purpose of a router in these configurations.

Physical controls. Consider the need for appropriate physical controls over the wireless system. Most wireless systems suitable for long-haul applications have an antenna that is separate from the transmitter/receiver unit. This separation allows placement of the antenna on the rooftop or otherwise outside the building. Strongly consider the possibility of such an installation when choosing equipment, and carefully ensure that physical controls to all parts of the installation are appropriate. Indeed, under no circumstances should a network connection be installed away from the bank’s physical premises, although sometimes shared-tenancy buildings necessitate antenna cable installation through common access spaces. Banks should ensure that physical controls are appropriate for such a situation, and even then, no cabling or part of the infrastructure should be readily available to the public.

Be certain that all components of the wireless system are secured by appropriate physical controls. To guard the antenna, rooftop access should be limited. Connections outside the building should be secured to the extent possible through lockable enclosures and tamper-preventing measures such as weatherproofing sealants or tamper tape. As is true of any other network device, the transmitter/receiver and any routers or firewalls should be located within locked facilities.

Monitoring and Maintenance. Following installation of a wireless system for transmitting bank data, careful monitoring is a must. Procedures should be implemented to monitor traffic and signal conditions to watch for signs of signal interception. Such warning signs include packet loss, increased usage, temporary carrier loss, or weakened signal strength.

Consider employing properly managed Intrusion Detection Systems (IDS) designed around detection of malicious traffic over the wireless link.

Finally, to receive timely notification of security issues and software updates, subscribe to notification mailing lists for all equipment deployed as components of the wireless system.

Conclusion

Security issues should figure heavily in management’s decision to implement a wireless system to transmit bank data. Security controls that are appropriate for wireless banking applications should be built into wireless implementations and constantly monitored for weaknesses or breaches. Improper controls could introduce a serious weakness into a bank’s data security posture. With appropriate controls in place, a long-haul wireless system could be a safe and cost-effective solution to a bank’s ever-growing data transmission.