User manual HP COMPAQ DC7100 ULTRA-SLIM DESKTOP PC WIRELESS SECURITY

[. . . ] 8 Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 For more information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1 Executive Summary Today's mobile workforce increasingly demands convenient and secure access to the Internet using mobile devices (such as notebook and handheld PCs) with HP Wi-Fi and other mobile connectivity solutions. A secure solution enables a mobile worker to gain safe network access in areas where it is traditionally hard to deploy "wired" networks. [. . . ] New features may be added easily by installing new modules. This architecture gives users an easy-to-use, all-in-one security solution. 3 Wired Equivalent Privacy Although most wireless security concerns have little or nothing to do with the wireless nature of the devices, there is some validity to the apprehension regarding the vulnerabilities of the Wired Equivalent Privacy key. WEP is an encryption algorithm designed to provide wireless security for 802. 11 wireless networks. WEP security issues can be summarized in four main points: · Web Key Recovery · Unauthorized decryption and violation of data integrity · Poor key management and · Access Point association All wireless vendors have taken steps to address these concerns. The IEEE response to the WEP key issue is 802. 11i (802. 1x Authentication) and Wi-Fi Protected Access (WPA). In fact, all HP devices will support Wi-Fi Protected Access, and the high-level authentication provided by 802. 1x Enhanced Authorization Protocol. Also, these devices support TKIP and AES Encryption. We are focused on what is available today, as it is hard to predict future changes in wireless technologies as they are emerging and IP networks are evolving to IPv6. The table below addresses the various solutions that vendors have developed to address the weaknesses discovered in WEP vulnerability. Vendor Solutions for WEP Vulnerability Virtual Private Network Implementations HP solutions: HP Production WLAN HP Wireless Internet Access Although VPN provides adequate security, there may be issues with roaming, cost, throughput and usability. Some solutions include: HP Production WLAN: Provides a routable IP address controlled by Security Policies allowing only access to Corporate VPN servers. Because you have to implement VPN using secure ID to gain Internet access, this is more secure HP Wireless Internet Access Solution: Provides full Internet access for on-site customers/vendors. Access is vended via Network Access Controllers that only allow Internet access after the client accepts a Legal Disclaimer. VPN is required if some intranet data is needed. In most cases, this is not needed as most productivity applications can be accessed using reverse proxy. This is very flexible and resilient to "edge of the network" changes. Dynamic WEP key CISCO Hewlett Packard Microsoft Implementation of Dynamic WEP re-keying of Access Points. In this solution, short-lived WEP keys are dynamically generated and broadcast. The time interval is short enough that the attacker will not have enough data to crack the web key. Initially, this solution introduced interoperability issues. Now it is the standard for Wi-Fi Security and was the seed for the WPA and 802. 11i. Enhancements of WEP Key (40-64 bit WEB) Lucent 128 bit Agere 152 bit WEB US Robotics 256 bit WEP MAC Address Filtering Server based Access point based This extension of the WEP key did not help with security, as the WEP vulnerability issues persisted (for more information, click here). It might take longer to crack the key but it does not help. Filtering solutions are difficult to manage. Spoofing the MAC address is possible, but some Access Points can hold 30 MAC addresses, which requires you to feed in to all Access Points and tack them. 4 Vendor Solutions for WEP Vulnerability Other security measures Hiding the SSID Limiting the RF propagation Hiding the Service Set Identifier (SSID) is not a valid security measure. Because management frames on 802. 11 Wireless LANs are always sent in the clear, this mode of operation does not provide adequate security Limiting propagation is hard, although it is possible in certain environments Wi-Fi Protected Access Fortunately, the Wi-Fi Protected Access (WPA) subset of the 802. 11i solution is available to address the vulnerabilities in WEP key access, until the full 802. 11i solution ­ driven by the industry ­ is available. [. . . ] Certified products will carry the WPA2 certification label. HP officially supports the Cisco-Compatible Extensions program. This is a formal certification program that attests to certified HP products interoperating with unique features of Cisco wireless LAN infrastructure As wireless LAN security improves over time, users will continue to find stronger data protection and user authentication, as well as improved interoperability. Microsoft Windows XP Service Pack 2 offers enhancements for wireless security that address many wireless concerns related to WPA, 802. 11i ­ and connectivity in general. [. . . ]