Wireless networks are less secure than wired ones
because the wireless connection that enables you to access the network
from afar can also enable an intruder from outside your home or office
to access the network. In particular, wardriving
is an activity where a person drives through various neighborhoods with
a portable computer or another device set up to look for available
wireless networks. If the person finds a nonsecured network, he uses it
for free Internet access or to cause mischief with shared network
resources.
Note
If you don’t believe
that your wireless signals extend beyond your home or office, you can
prove it to yourself. Unplug any wireless-enabled notebook and take it
outside for a walk in the vicinity of your house. View the available
wireless networks as you go, and you’ll probably find that you can travel a
fair distance (several houses, at least) away from your wireless access
point and still see your network.
Here are a few tips and techniques you can easily implement to enhance the security of your wireless network:
Enable encryption—
First and foremost, enable encryption for wireless data so that an
outside user who picks up your network packets will be unable to
decipher them. Be sure to use the strongest encryption that your
equipment supports. The most popular encryption method is Wired Equivalency PrivacyWEP).
Older devices support only 64-bit WEP encryption, which is adequate for
thwarting casual snoops. For more robust security, use 128-bit WEP
encryption. Even better, use Wi-Fi Protected Access (WPA), which is even stronger than WEP, although it’s a bit more complex to set up. ( Tip
WPA
isn’t so complex if you use the simplest settings. For the security
mode, select WPA Pre-Shared-Key, which doesn’t require an authentication
server. For the WPA algorithm, select TKIP (Temporal Key Integrity Protocol),
which works on most setups that support WPA. For the shared key, create
a strong password between 8 and 63 characters long. Be sure to store
this in a safe place because you’ll need to adjust the wireless clients
to use it.
Note
If you change your
access point encryption method as described in the previous tip, you
also need to update each wireless client to use the same form of
encryption. In the Network Connections window, right-click your wireless
network connection and then click Properties. Display the Wireless
Networks tab, click your network in the list, and then click Properties.
Change the following three settings and then click OK:
| Network Authentication | Select WPA-PSK. | | Data Encryption | Select TKIP. | | Network Key | Type your shared key here and in the Confirm Network Key text box. |
Disable network broadcasting—
Windows XP sees your wireless network because the access point
broadcasts the network’s SSID. However, Windows XP remembers the
wireless networks that you have successfully connected to. Therefore,
after all of your computers have accessed the wireless network at least
once, you no longer need to broadcast the network’s SSID. Therefore, you
should use your AP setup program to disable broadcasting and prevent
others from seeing your network. Change the default SSID—
Even if you disable broadcasting of your network’s SSID, users can
still attempt to connect to your network by guessing the SSID. All
wireless access points come with a predefined name, such as linksys or default,
and a would-be intruder will attempt these standard names first.
Therefore, you can increase the security of your network by changing the
SSID to a new name that is difficult to guess. Change the access point username and password— Any person within range of your wireless access point can open the device’s setup page by entering http://192.168.1.1 or http://192.168.0.1 into a web browser. The person must log on with a username and password, but the default logon values (usually admin)
are common knowledge among wardrivers. To prevent access to the setup
program, be sure to change the access point’s default username and
password. Consider static IP addresses— DHCP makes it easy to manage IP addresses, but it also gives an IP address to anyone
who accesses the network. To prevent this, turn off DHCP in the access
point and assign static IP addresses to each of your computers. Enable MAC (Media Access Control) address filtering— The MAC address is the physical address of a network adapter. This is unique to each adapter, so you can enhance security by setting up your access point to allow connections from only specified MAC addresses. Note
To find out the MAC address of your wireless network adapter, open a Command Prompt session and enter the following command:
Find the data for the wireless adapter and look for the Physical Address value. (Alternatively, right-click the wireless connection, click Status, display the Support tab, and click Details.)
Avoid windows—
When positioning your access point within your home or office, don’t
place it near a window, if possible, because otherwise the access point
sends a strong signal out of the building. Try to position the access
point close to the center of your house or building.
|
