Security: The Trouble With WiFi

Bob Egan worries about WiFi. And he wonders why no one is listening to him. Egan, the author of a WiFi security report and director of emerging technologies at Boston-based analyst firm TowerGroup, says that “WiFi security is a problem that just won’t seem to go away,” despite years of media coverage detailing the need for firms to secure the popular wireless networks.

The biggest issue: Many CIOs address WiFi security by banning wireless networks altogether. But WiFi is so easy and cheap to install, individuals are bypassing the IT shop and hooking up access points on their own. Add to that the fact that the average consumer now has WiFi connectivity in their laptop or smartphone, and “saying ‘no’ is perhaps the most dangerous thing to do,” says Egan. “Even if an organization doesn’t officially support WiFi, it probably exists on their campus. CIOs have to take appropriate measures to secure the enterprise.”

Some dangers are pretty obvious. Say, for example, the sales department deploys a renegade wireless-access point without IT’s knowledge, and a prospective client comes in for a sales call—carrying a WiFi-enabled smartphone. It wouldn’t take much to create a private tunnel into corporate systems, says Egan, where sensitive data could be accessed.

The problems with WiFi don’t end with security. “Let’s say you’re a small business in an office building, and another company moves in that’s also using WiFi,” says Egan. Because of the interference that’s created with additional wireless traffic, “all of a sudden, your network performance is being affected.” Home Depot Inc. dealt with a similar issue last year, adds Egan, when kids entering the stores with wireless gaming devices interfered with the stores’ point-of-sale and inventory systems.

Telecommuters are also a source of worry. According to Gartner Inc., at least 41 million corporate employees around the world will telecommute at least one day a week by 2008, many using WiFi networks at home. But by 2007, 80 percent of all U.S. residential wireless LANs will still be insecure. “What’s to prevent a neighbor from attaching to your wireless network, and then going up the conduit through your laptop right into your company?” asks Egan.

To boost security, consider deploying new intrusion detection software from companies like AirDefense Inc., Aruba Networks Inc. and WildPackets Inc., among others. These programs can tell the difference between a malicious hacker and an annoying—yet benign—nuisance, and take appropriate action to thwart attacks.

Whichever method you choose, “wrap your enterprise network with a prophylactic,” Egan says. “Otherwise, you’ll get hurt.”