& cplSiteName &

WPA's Insecure Legacy

Light Reading
LR Mobile News Analysis
Light Reading
4/14/2003
50%
50%

A coming upgrade for the 802.11 specification that is being promoted by the Wi-Fi Alliance cannot be supported by the majority of wireless LAN equipment already in use, prompting concern among analysts and vendors that older infrastructure could still be used as a backdoor into supposedly secure new networks.

WiFi Protected Access (WPA) is being promoted by the WiFi Alliance as a solution to the security issues that have dogged the adoption of 802.11, especially in the enterprise (see 802.11 Security Issues Sorted?). WPA is a security system comprising the elements already fixed and agreed upon by the Institute of Electrical and Electronics Engineers Inc. (IEEE) security task group, including: Temporal Key Integrity Protocol (TKIP) and Counter Mode with CBC-MAC Protocol (CCMP) for over-the-air encryption, and access control standard for user authentication and encryption key distribution. It is supposed to be more secure than the current WEP (wired equivalent privacy) security standard.

Products incorporating WPA are now being tested and should be certified and available in May. However, while the move is a step in the right direction, WPA will be of no benefit to anyone using existing 802.11b (11-Mbit/s over 2.4GHz) networks. The technology can only be incorporated in new 802.11b, 802.11a (54-Mbit/s over 5GHz) and 802.11g (54-Mbit/s over 2.4GHz) products. This is leading to concerns about enterprises mixing newly ratified WPA products with original hardware, as the network can only be as secure as the weakest access point.

“There are issues with WPA backwards compatibility with some products,” confirms Ian Keene, vice president of telecommunications research at Gartner Inc. “If an enterprise or home user went for a single vendor solution then we don’t expect too many problems, but it is a problem for interoperability between different vendors.”

Such issues could cause a major headache for the growing number of enterprises rolling out wireless LAN networks to their employees (see 802.11 WLAN Shipments Double and Europe Set for WLAN Boom). “It is not going to be possible to buy WiFi-Alliance-tested WPA products that are backwards compatible with every previous product, and that could be a big obstacle,” says Keene, adding that he expects to see compatibility problems with the current crop of wireless LAN cards on the market.

The vendors Unstrung spoke to claim to be tackling the compatibility issue. “We are looking into it because there are certainly areas that need to be resolved,” says Proxim Corp.'s (Nasdaq: PROX) solutions marketing manager, Jan Buis. “We are aware of this problem. Security is the hottest issue in wireless LAN at the moment, and as a vendor we must make it our highest priority.”

“We are trying to educate the enterprise user by telling them about these issues,” comments 3Com Corp.’s (Nasdaq: COMS) international segment manager for wireless and security, Angelo Lamme. “A network, after all, can only be as secure as the weakest link.”

While no enterprise is immune to the compatibility problems, both vendors point out that it is the latest adopters of wireless LAN, rather than the earlier, tech-savvy enterprises, that require the greatest amounts of education as to the potential for security holes in the network. “The early adopters of wireless LAN accept some of the insecurities that exist today,” says Buis. “The primary reason why new security features have entered this market is because of the number of customers unwilling to use wireless LAN at present.”

In the short term, at least, vendors in this space face the task of informing users of the pitfalls involved in mixing old and new infrastructure. “This is an ongoing problem,” concludes Gartner’s Keene. “We expect it to be resolved in the next two years, but it isn’t going to happen overnight. It really depends on how well vendors can work with each other to help iron out the problems.”

These latest concerns will do little to combat the growing fear of security problems with enterprise wireless LAN use. In a recent Unstrung poll of readers, 72 percent of respondents perceived security as the major drag on wireless LAN deployment within corporations (see Poll: WLAN Has Limited Life). Recently, RSA Security added fuel to the fire by highlighting the ease with which corporate networks can be hacked (see Hackers Crack London WLANs).

— Justin Springham, Senior Editor, Europe, Unstrung

(0)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Light Reading’s Upskill U is a FREE, interactive, online educational resource that delivers must-have education on themes that relate to the overall business transformation taking place in the communications industry.
NEXT COURSE
Friday, September 30, 1:00PM EDT
Gigabit & the Great Migration
Robert Howald, Vice President, Network Architecture, Comcast
UPCOMING COURSE SCHEDULE
Wednesday, October 5, 1:00PM EDT
Gigabit & Smart Cities
Joe Kochan, COO & Co-Founder, US Ignite
Friday, October 7, 1:00PM EDT
Gigabit & DOCSIS 3.1
Ty Pearman, Director, Access Architecture, Comcast
Wednesday, October 19, 1:00PM EDT
Securing a Virtual World
Rita Marty, Executive Director, Mobility and Cloud Security, Chief Security Office, AT&T
in association with:
From The Founder
Light Reading today starts a new voyage as part of a larger Enterprise.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
LRTV Custom TV
Flexible Deployment Approaches for the Gigabit Services Evolution

9|29|16   |     |   (0) comments


For many operators, the gigabit evolution begins with the shift from DOCSIS 3.0 to DOCSIS 3.1. But that move represents a change not only in the protocol itself, but in the approach to architecting their entire DOCSIS delivery chain -- from the headend to the outside plant and home gateway components.

Jonathan Ruff, senior director of global technical ...

LRTV Interviews
Level 3 VP: Enterprises Need More for Less

9|29|16   |   05:27   |   (0) comments


Andrew Dugan, Level 3 group vice president of global technology and IT, says enterprises need more bandwidth and they need it faster and with greater security, but they want to spend less, if possible. They are looking to carriers to reduce their network complexity and help protect them from cyberattacks as well.
LRTV Interviews
CenturyLink: SDN/NFV Pose New Interconnection Possibilities

9|28|16   |   04:37   |   (0) comments


Network operators should develop new APIs and business processes for reselling virtual assets to each other, says CenturyLink's Bill Walker. That will enable them to build digital business portfolios that help them avoid becoming commodity transport providers.
LRTV Interviews
Level 3: Overcoming Terror of Being Supplier, Integrator & Developer

9|28|16   |     |   (0) comments


At Light Reading's NFV & Carrier SDN event in Denver, Travis Ewert of Level 3 Communications said there is terror in becoming supplier, integrator and developer, but it can be overcome and be cost effective.
LRTV Custom TV
Introducing IoT World News

9|27|16   |   01:43   |   (0) comments


Self-driving cars, medical sensors, smart cities... and refrigerators. In order to address the huge scope of IoT, KNect365 has created a unique online community that will help businesses to understand and monetize the opportunities that live within the IoT market. We look forward to welcoming you to IoT World News -- your gateway to a better connected future.
LRTV Interviews
AT&T: Reusable Functions Next NFV Key

9|27|16   |   06:03   |   (0) comments


The next generation of NFV has to break functions down into reusable software chunks, making everything much more cloud-like.
LRTV Interviews
Masergy on Security: Attackers Gaining Upper Hand

9|27|16   |   5:10   |   (2) comments


At Light Reading's NFV & Carrier SDN event in Denver, Ray Watson, vice president of Global Technology at Masergy, says that because of the growth in virtualization, the threat landscape is shifting in favor of the attackers. As a result, service providers need to think beyond just defending the perimeter and take a more holistic approach to security.
LRTV Interviews
Verizon Takes Next Step on Biz Virtualization Journey

9|26|16   |   4:38   |   (2) comments


At September's NFV & Carrier SDN event in Denver, Light Reading sat down with Victoria Lonker, director of Product and New Business Innovation at Verizon, to chat about where the carrier is with delivering virtualized services to business customers.
LRTV Interviews
Global Services: The $40B Face-Off

9|26|16   |   05:53   |   (1) comment


More service providers than ever before are battling it out to win a slice of what is now a $40 billion global communications services pie, explains Ovum Principal Analyst David Molony.
LRTV Documentaries
MEC Congress: The Key Takeaways

9|22|16   |   03:25   |   (3) comments


Three key takeaways from the Mobile Edge Computing (MEC) Congress in Munich, Germany.
Wagner’s Ring
Time to Shut Up About 'Dumb Pipes'

9|22|16   |     |   (19) comments


Service providers can't compete with OTT players. It just isn't in their DNA. Instead, service providers need to embrace what they're good at -- providing reliable, secure connectivity.
Wagner’s Ring
Keeping Your Tech Career Going After 50

9|21|16   |     |   (13) comments


How do you keep your career moving forward when you're past the half-century mark?
Upcoming Live Events
November 3, 2016, The Montcalm Marble Arch, London
November 30, 2016, The Westin Times Square, New York City
December 1, 2016, The Westin Times Square, New York, NY
December 6-8, 2016, The Westin Excelsior, Rome
May 16-17, 2017, Austin Convention Center, Austin, TX
All Upcoming Live Events
Infographics
Hot Topics
WiCipedia: The Women Helping Women Edition
Eryn Leavens, Special Features & Copy Editor, 9/23/2016
Eurobites: Telefónica Taps Juniper for Network Security
Paul Rainford, Assistant Editor, Europe, 9/26/2016
Open Source Getting on My Nerves
Carol Wilson, Editor-at-large, 9/26/2016
Powell Kills the Cable Show
Mari Silbey, Senior Editor, Cable/Video, 9/29/2016
Telstra Sees Quadrupled Data Capacity by 2020
Carol Wilson, Editor-at-large, 9/28/2016
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
Light Reading CEO Steve Saunders and UXP Systems CEO Gemini Waghmare discuss the strategic importance of digital identity for operators in the midst of transformation.
Join us for an in-depth interview between Steve Saunders of Light Reading and Alexis Black Bjorlin of Intel as they discuss the release of the company's Silicon Photonics platform, its performance, long-term prospects, customer expectations and much more.
Animals with Phones
There's Nothing Like Missing a Full Minute of Pokémon Go Click Here
Live Digital Audio

A vital part of increasing the number of women in comms is transforming the ways companies can support and empower women. While progressive company policies that support both men and women in achieving work-life balance are a step in the right direction, creating a company culture that supports those policies can at times be more challenging.

During this show, we'll talk to Lynn Comp, Senior Director of Industry and Sales Enabling (ISE) in the Network Platforms Group at Intel, about why those challenges exist and how companies can overcome them. She'll provide insight into how Intel has worked to create a culture that supports work-life balance, and provide steps and guidance for other companies wishing to do the same. We will also leave plenty of time to get your questions answered live on the air.