Security Policy—A Range of Options

 
Security Policy—A Range of Options
You need to know what is being protected. These could be devices such as servers, routers, modem
banks, and information such as e-mail, intellectual property, trade secrets, customer lists, business plans,
and medical records. Sometimes the information has to be protected by law. You also need an idea of
who this information is being protected from—hackers, customers, insiders (employees and contractors),
and competitors. From this information, a simple risk analysis can be performed to determine what is at
risk (data or the network) and the level of countermeasures required to solve the problem. In risk
management, you can ignore, accept, defend, or pass on a problem. Unfortunately, there is no canned
security policy that you can obtain or use. Each business has its own unique requirements and practices
that dictate how implementations are made. Table 4-2 shows the varying levels of security, the
configuration, what is secured by the configuration, and what applications such a configuration might be
used in.
Table 4-2: A range of security options for wireless networks
Security Level Configuration
What Is
Secured? Applications
0 No security Network out of the
box and no
configuration (no
WEP)
Nothing There is no legitimate
unsecured application.
Nevertheless, many
users operate their
equipment in this mode
out of the box.
1 Public access User authentication
and must supply
VPN through the
Internet back to the
enterprise
Network access Hot spots, libraries,
coffee shops, hotels,
airports, and so on with
portability
2 Limited security 40- or 128-bit WEP,
MAC access control
list (ACL), and no
broadcast
Some network
access and
data privacy
Home and SOHO with
portability
3 Basic security Wi-Fi Protected
Access (WPA) (later
802.11i)
Network
access and
data privacy
Home, SOHO, and
small enterprise with
portability
4 Advanced
security
802.1x/EAP-X and
RADIUS
Network
access and
data privacy
Enterprise with
portability
5 End-to-end
security
VPNs such as the
Point-to-Point
Tunneling Protocol
(PPTP), PPTPv2,
Layer 2 Tunneling
Protocol (L2TP),
Kerberos, and IP
Security (IPSec)
Network
access and
data privacy
Special applications,
business travelers,
telecommuting,
business to business,
and enterprise with
outside users