Wireless in the Workplace

Hi guys and gals, I need a little help.

We recently purchased and installed a wifi security product called HiPath Wireless Manager, which is currently owned by Entarasys. Basically, using sensors scattered around the buildings where I work, it detects signals from WiFi devices and tries to triangulate their positions on maps we've put in HiPath's locations database. It also has the capability to block communications between devices, such as between an authorized client and a rogue access point. It's a pretty decent product; it needs a little work, but it'll do.

That's not the problem.

Lately, users have been bringing in these MiFi devices--WiFi routers which connect to a cellular network, for those who don't know. Some of these run off batteries, and are about half the size and twice the thickness of a credit card. Our Internet security policy states that you are not allowed to have any device connected to our internal network and another network simultaneously. It also states that no non-corporate-owned or managed device can connect to our internal network. These MiFi devices don't allow people to connect to our internal network; they simply allow them to connect straight to the internet.

My boss is wondering why I'm worried about these MiFi devices, and I keep telling her that although we can see the MiFi devices, we are unable to see whether or not whatever's associated with these devices (laptop, etc) is connected to our internal network via ethernet without chasing down each signal, and physically looking in the cubicles to see whether or not their laptops are connected to the networks. Also, these employees could be wasting time surfing the net without the fear of being logged. The boss says that's more of a productivity problem, and not a security problem.

So, can someone give me a case that these MiFi devices are not only bad for productivity, but also from a security standpoint?

nc -lv 1234 < \\server\share$\supersecret.doc :D

Quote:

---

Originally Posted by NukEvil

So, can someone give me a case that these MiFi devices are not only bad for productivity, but also from a security standpoint?

---

Depending on the security settings of each station/laptop/whatever the MiFi is connected to, it could be an open hole to the machines it connects with and the internal network.

Apart from that.... you say your security policy doesnt allow this? Then why is it possible from a technical point of view to work? Cant you lock down the company's computers? We would need much more info on your network and hardware and OS involved in the whole thing.

I dont know what systems you are using, but on the PCs and laptops i administer, the user can not connect to any wifi that is not set in the config files, he can not install any other wifi client since he does not have access to install such, and he has no access to add any USB devices either (so not even a router/modem/MiFi with usb would work). (Thats for linux, i have no idea if that is even possible with windows).

The security policy should not ONLY state what is allowed and what not, but it should also ENFORCE what it states using technical means.

I should probably have mentioned that the laptops aren't company-owned, either. The employees bring both laptop and mifi device from home. And they don't connect them to the internal network; they simply want to access the internet with them.

Quote:

---

Originally Posted by NukEvil

I should probably have mentioned that the laptops aren't company-owned, either. The employees bring both laptop and mifi device from home. And they don't connect them to the internal network; they simply want to access the internet with them.

---

Are these private laptops used for company work? Do they carry company files? Do they connect to anything company related other than using them for internet during company operating hours? Is your concern for the mifi's only for their private laptops? What does your security policy say about using private laptops?

Im sorry dude, but from what you have said so far, its still not easy to understand the 'what-is' situation, and the 'should-be' situation.

If the private laptops are not connected to the company network, and no company work is performed on the private laptops, then there is no real security risk, but it sounds rather like a productivity issue.

IF they use their private laptops for company work but cannot connect to the internal network, then how does their 'work' transfer from the company network on to the private laptops? (usb, email, ftp over the net)???? And if thats the case, then IT IS a security concern, although once again the company policy should dictate and enforce counter measures to these problems.

Cheers

That's the thing; we don't know if they use the laptops only for internet access or if they also do work on them. I kinda doubt they'd use them for working purposes because of the desktop computer that every occupied cubicle has.

As in my first post:
Our Internet security policy states that you are not allowed to have any device connected to our internal network and another network simultaneously. It also states that no non-corporate-owned or managed device can connect to our internal network.

It doesn't really state anything about countermeasures, other than "blah blah subject to punishment up to and including termination and possibly prosecution"...

Quote:

---

Originally Posted by NukEvil

That's the thing; we don't know if they use the laptops only for internet access or if they also do work on them. I kinda doubt they'd use them for working purposes because of the desktop computer that every occupied cubicle has.

As in my first post:
Our Internet security policy states that you are not allowed to have any device connected to our internal network and another network simultaneously. It also states that no non-corporate-owned or managed device can connect to our internal network.

It doesn't really state anything about countermeasures, other than "blah blah subject to punishment up to and including termination and possibly prosecution"...

---

So the only 'security' breach that i see (maybe someone else can see more) is, that if a user uses a USB stick to copy files from his cubicle PC and copies them on to his laptop, the files are as safe as the user's private laptop.

In any event, if thats not the case... then its a productivity issue since they seem to need to bring in their own 'internet' to go online. I presume that using the net from the company PCs' is no fun? Locked down etc?

However.. what makes "YOU" think there is a security issue involved? Am I missing something maybe?

Cheers.

Quote:

---

So, can someone give me a case that these MiFi devices are not only bad for productivity, but also from a security standpoint?

---

I don't understand how productivity loss isn't sufficient enough to warrant attention.

From a security standpoint, these users are introducing unmoderated internet into the workplace. If you can't guarantee that users won't connect their laptops to your internal network, then it is a security problem.

My personal view (as an old fart with a free bus pass to prove it:D) is that I entirely agree with ShagDevil's post. That would be what I would expect of a normal corporate reaction, to what should be a non-corporate situation?

I appreciate the posts that suggest that this should not be a problem ( other than productivity) but I wonder how you can actually prove that? After all, if anything goes wrong, your only defence is going to be due diligence.......... and how are you going to demonstrate that?:(

I will readily admit that I know nothing about this technology, but it appears to be a situation where one is bringing an insecure wireess environment within range of a supposedly secure one?

I guess that my first move would be to formally request the provision of similar equipment so that I could investigate the potential problems.

Looking at my home network, I know that if I introduce a wireless device, it will see the router, but will require an access code to get accepted onto the network. Otherwise I believe that all that is possible is to use the wireless connection.

I think that the authentication works on the MAC address of the attached device, but I haven't really investigated. :dunce:

I do wonder if I removed the USB WiFi adapter from one machine, would it work in another; without re-authentication?

Thanks for this interesting thread...............you have gotten me thinking..........but only whilst sober :drink:

:D

Quote:

---

Originally Posted by nihil

I think that the authentication works on the MAC address of the attached device, but I haven't really investigated. :dunce:

I do wonder if I removed the USB WiFi adapter from one machine, would it work in another; without re-authentication?

---

It authenticates...most of the mifi units, if not all of them are a Novatel device, commonly the 2200. I have one. You have to authenticate, unless the owner of the device turned off the protection. I think they use WEP default, but you can change it to WAP2. Virgin Mobile recently dumped a prepaid version on retailers that rides on Sprint's 3G network. $40/month for unlimited data. They did recently announce, though, that they will cap the speeds to 256k after you break the 5Gb mark for a month.


I don't think they represent any more of a risk to your network than a usb thumb drive.

About the work productivity thing. Heh, guess that depends on what school of thought you come from.

Why do they bring in their personal laptops to work? We had the issue here where temp employees would bring their unsecured laptop onto our network, put a stop to that. Its very hard to control your equipment when its not even yours.

Quote:

---

I don't think they represent any more of a risk to your network than a usb thumb drive.

---

That should be possible to control and lockdown, since this is a security issue in this current scenario.
(im still not sure if its possible on windows to lockdown for example hotplugging a usb device)

Quote:

---

About the work productivity thing. Heh, guess that depends on what school of thought you come from.

---

I agree. Whilst productivity is an issue here, it depends how relaxed the situation is at this workplace. To be honest... (as long as its not on company machines) I dont think its 'THAT' bad if a user wants to check his email, or maybe they have some software to track their children or something, but if the users start spending time on facebook, twitter, or just surfing the net then it could be a pain.

What number of private laptops/netbooks are we talking about here anyways? A majority?
If you can lockdown the following:

- USB hotplugging &
- User being able to connect to an additional network

then i would say the security side has been taken care off, so the only thing to talk to your boss about would be productivity (if this falls under your jurisdiction).

However:

Quote:

---

Why do they bring in their personal laptops to work? We had the issue here where temp employees would bring their unsecured laptop onto our network, put a stop to that. Its very hard to control your equipment when its not even yours.

---

still is the best advice regardless of private opinions!

Please excuse my ignorance here as these MiFi devices are new territory for me :D What are they actually connecting to? Is it their own private ISP account, or is it the corporate WiFi node?

If it is a private ISP, then I don't see how it is that much different from bringing a mobile (cell) phone into the workplace, from a security viewpoint?

If it is the corporate WiFi, it shouldn't really be a problem, as you should not be able to access the corporate LAN or WAN with an unauthorised device? As I mentioned earlier I only have my (crude) home network to go by; but that will not authenticate a new device without the wireless key (password).

I have been doing a bit of experimentation with 5 computers that are wirelessly connected to my network. The OSes are:
Windows 2000 Pro
Windows XP Pro (x2)
Windows XP Home
Windows Vista Home Premium.

Three of them have identical 802.11n USB adapters and the other two have different makes.

The three identical ones will hotswap (irrespective of OS), whilst the other two will not. They fail at the desktop because the correct drivers/management software is not loaded. That is pretty much what I expected.

I also tried USB memory sticks, keyboards and mice :D

Windows is rather more subtle than I expected!!! :eek:

1. If Windows has seen the device before, it just informs me that it has been mounted and recognised.

2. If Windows has not seen the device before, it goes into "Found New Hardware" mode and wants to look for the Windows drivers for it, to install the "new hardware". Users should not have the authority to do this.

In the case of USB memory sticks, it will do this EVEN IF IT IS THE EXACT SAME MAKE AND MODEL as one it already recognises. I am not sure about keyboards, but a cheap optical USB wheel mouse will be recognised if it is the same make & model. I am not really concerned about that, as I would have thought that the MiFi device was at least as complex as my WiFi adapters, and would need software loading to work?

So, my thoughts are that if the users are prevented from installing new hardware, new software and from accessing the corporate networks with an unauthorised device, you should be pretty secure.

I am not sure what would happen if you tried to connect via an authorised device using CAT5/RJ45, but I would have thought that the desktop should be locked down against connecting new hardware, and the user would not have the authority to allow sharing? Also, I would expect that what the authorised device was doing would show up in the logs?

Quote:

---

I don't think they represent any more of a risk to your network than a usb thumb drive.

---

Probably less, as you can take a memory stick home and get it infected, then bring all the goodness back to the workplace. :cool:

The only problem I can envisage that doesn't seem to have been mentioned, is that these are private devices within range of the corporate WiFi. There might be an issue of interference, particularly if one of the devices is in the process of failing. That would be difficult to trace as the device is not connected to the network.

As for productivity, that is normally an HR (human remains? :lildevil:) issue, rather than an IT one.

To me, the main issue would be if it is the corporate WiFi that is being used. If it is, then I would say that there is an issue, as anything that is done will trace back to the company, including downloading illegal material?

Just a few thoughts :)

A MiFi device connects directly to the cellular network, and lets devices connect to it to use that connection for internet access--sort of like a wireless router whose WAN interface connects directly to the nearest cellular tower.

And some of these things are TINY. I think I mentioned that I've seen one that's about half the size, but twice the thickness, of a credit card. But I can detect every one of them from a central console due to their WiFi signal, and try to triangulate their location on the buildings' floorplans. If I need to, I can disrupt the WiFi communication so any device associated with these MiFi devices gets disconnected over and over again.

But, for now, all I'm doing is going to each signal I find, taking down the name of the owner and cube number, and putting that in a database, with an association with the device's MAC address. Just in case policy ever changes in a way that prohibits these devices...

So I'm gathering that this particular issue may be more of a productivity issue than a security issue. And we'll be able to control how USB devices are treated on any endpoint on the network pretty soon. So the MiFi 'problem' may become more of a moot issue.

A question: I've installed dd-wrt on all my routers at home, and I've noticed a feature that allows an access point to connect to another access point as a client. Is there a way that MiFi devices could do the same thing? I'm asking because of our workplace WiFi infrastructure and all...

Is there not some kind of co$t associated with this extra traffic??

Sometimes thats all the powers that be are concerned with... :rolleyes:

MLF

Quote:

---

Originally Posted by NukEvil

A question: I've installed dd-wrt on all my routers at home, and I've noticed a feature that allows an access point to connect to another access point as a client. Is there a way that MiFi devices could do the same thing? I'm asking because of our workplace WiFi infrastructure and all...

---

As far as I'm aware, no, not really. I haven't read about anyone that's successfully replaced the firmware. I haven't tried b/c I don't want a brick. You can set a mifi as your internet AP point and connect another router to the mifi to allow more than the five devices the mifi would allow, but going the other way doesn't work. Actually, I lie, I think you could pull it off, but it would be pointless, you would just have added a router to your existing work network and the point of the device would be ruined.

Nihil, as the US cell carriers are moving towards integrating 4G, they're left with a 3G backbone that they need to try to make money off of. So most carriers are now offering these devices that work strictly on their 3G networks, verizon offers 4G service, but it's expensive. It doesn't touch the official "interbutts" as it were, it is a private network, in a sense.

Hmmmm,

As I understand it, these MiFi devices are intended to connect to a cellnet tower, so I imagine that they communicate rather differently from standard wireless cards or USB adapters? I am assuming that the external router connection is wired?

Why would you want to connect to the company's WiFi, which you know is monitored and logged? If I control the gateway, I know who and what goes in and out.

If, on the other hand, if it were possible for a user to connect one of these MiFi devices to a company computer and run it at the same time as the regular corporate connection, but through the private carrier, then you would have a problem. You would have a rogue connection to your network that would potentially compromise your security. I am not even sure if this would be possible in Windows without having a separate user account and/or hardware profile? It sounds a lot less hassle just to use your private laptop.

Having said that, your network security software should be scanning for unauthorised devices attached to endpoints.

The MiFi devices should not be able to connect to your routers anyway, even if it were technically possible, because they should fail authentication. They are, after all, just another wireless device seeking access.

Also, users should not be able to install programs on corporate machines. This should prevent them installing complex hardware that needs its own drivers and other software. I am pretty sure that Windows does not provide native support (I am not sure about Windows 7) for these MiFi devices. I am basing this on the fact that all my WiFi adapters needed their own software installing before they would work; that's Windows 2000 Pro through Vista.

Quote:

---

And we'll be able to control how USB devices are treated on any endpoint on the network pretty soon.

---

Oh dear! you mean to say that you are not doing that already? That is a much bigger security issue than MiFi devices IMO.:eek:

Quote:

---

Originally Posted by nihil

Hmmmm,

As I understand it, these MiFi devices are intended to connect to a cellnet tower, so I imagine that they communicate rather differently from standard wireless cards or USB adapters? I am assuming that the external router connection is wired?

---

Totally unwired, that's the point of them. They're essentially cell phones on rhoids that take a cell signal and convert it to 802.11 WLAN prots. Like the little dongles they've been putting out for years now. These just happened to have a halfway decent wireless router stuffed into them. They're really quite nifty...I was shuffling my little brother and a couple of his friends around a bit ago, and when they realized they had a connection for their psps and itouches I was like "Uberman". Now they won't stop harassing me for a ride.

Quote:

---

Originally Posted by nihil

Oh dear! you mean to say that you are not doing that already? That is a much bigger security issue than MiFi devices IMO.:eek:

---

Well, we would be doing that by now. In fact, we should have been doing this for the past month. Unfortunately, a project manager got wind of it, and has demanded we put her process in place before anything gets installed. I mean, she literally forced herself into the meeting room where we were planning on the location of installing the kit and ordered everyone to stop what they were doing. The system they make people put their 'projects' on is several levels deep and dozens of options per level. By the time project management is through, your 'project' is several months late.

The way things are going, I wouldn't be surprised if a short trip down a long, empty elevator shaft came up in her future...

I believe 'PMO' is a four letter word...in spirit if not in fact.

This is a great discussion. It has touched on the many layers of protection an organization needs to consider and adopt...or waive. I see a couple of key points that should walk you straight to your answer, NukEvil... (apologies if these were better summed up already.)

1. Can users connect personal systems to company network? (Caveat H4x0r: Not "are they allowed to" but "does something physically/logically stop them"?)

2. Can users connect company systems already on the company network to MiFi access points (Same caveat as #1)?

If either of these are answered "YES", I think you have a strong case to create an administrative control denying the use or even possession of a MiFi type device in the office workspace.

http://j.mp/ch2bYm <- relevant dilbert-ness

The USB storage issue is relevant, but its a separate issue. The MiFi has no impact on that issue because you can sneaker net a flash drive home with you as easily as you can use it to move bits the three feet from the official desktop to your personal laptop...the fact that information can be moved to a highly portable and unmanaged storage mechanism is the problem in that issue.

Hope that helps.


(Nihil et al...how's that for a comeback from a 3 year silence?)

Hey there Zen, how the devil are y'all?

:D:drink:

Quote:

---

Originally Posted by nihil

Hey there Zen, how the devil are y'all?

:D:drink:

---

Busy as hell, but it beats the alternative. Mentioned AO to a friend/security n00b, brought up the site and showed him, and decided to say hi. Hopefully I'll hang around for awhile again. :cool: