RE: WLAN in a secure SME environment

["Mark Johnston" <mark.johnston () bluesq com>]

Hi there,

The WLAN should be seperated from your LAN by firewall, as essentailly you have a zone that you don't trust. To further 
increase your secruity, I would recommend as you suggested that all wireless clients establish a VPN tunnel either to a 
dedicated gateway or to the seperating firewall itself. If you have a 2 factor auth system, then I would make use of 
that as well.

Cheers
Mark

-----Original Message-----
From: Shaineel Singh [mailto:ssingh () kbs net au]
Sent: 03 November 2004 06:25
To: security-basics () securityfocus com
Subject: WLAN in a secure SME environment


Hi,

I am in the process of providing a solution for an SME that currently
employs both wired and wireless clients. I can provide rudimentary
security for the WLAN by hardcoding MAC addresses on the AP and
disabling DHCP amongst other methods.

My question to the list is this, besides making sure that very little
information is sent via cleartext in wireless mode to circumvent
wireless sniffing, etc. what sorts of methods could I use to effectively
segregate the WLAN and LAN? We are talking about a M$ environment with
winXP being the operating system on most laptops and workstations. Would
it be easier to just have a VPN setup when clients are forced to use
wireless as their access method?

Shaineel Singh
p: +61 411 046 935
e: mailto:ssingh () kbs net au
w: http://203.220.32.126/~ssingh/ 

pgp: 91AC 0F02 B206 36F9 F414  D1EE 8545 94F0 7804 A1EF




**********************************************************************
This e-mail and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they 
are addressed. It may not be used or disclosed except for the 
purpose for which it has been sent. If you have received this 
e-mail in error please notify the system administrator 
postmaster () bluesq com quoting the senders address. If you are not the 
intended recipient you must not use, disclose, distribute, copy, 
print or rely on this e-mail and must delete the message and any 
documents. Please advise immediately if you or your employer 
do not consent to Internet e-mail for messages of this kind. 
Unless expressly stated, opinions in this message are those of 
the individual sender and not of Blue Square. Blue Square 
accepts no liability or responsibility for any onward transmission 
or use of e-mails and attachment having left the Blue Square domain.

 

This footnote also confirms that this e-mail message has been swept
 by MIMEsweeper for the presence of computer viruses. Whilst we 
have taken reasonable precautions to ensure that this e-mail and 
any attachments have been swept for viruses, we cannot accept 
liability for any damage sustained as a result of software viruses and 
would advise that you carry out your own virus checks before 
opening any attachment.

 

www.bluesq.com
**********************************************************************