[Full-Disclosure] Wireless Security

["Patrick Doyle" <patrick.doyle@bbc.co.uk>]

Hope this question isn't off topic, 

I am currently looking at securing wireless networks using Cisco hardware and 
wanted to check what peoples thoughts are on security.

I have read about using LEAP and also IPSEC, my concerns about using LEAP would 
be that although the client and access point send hashes of the username and 
password, and also dynamically create WEP keys, the process is still vulnerable 
to brute force attacks.  Now i know you can lock down the Access Point (AP) to 
specific MAC addresses, however, in our environment i can see wireless being 
used for meeting rooms etc, so the users would be random which would mean the 
constant addition / removal of MACs to the AP which would probably not be 
possible or practical all of the time.   Although policy could dictate that 
when a wireless card is given out, the MAC address in added to the AP, however 
if you have multiple APs in different areas of building, being administered by 
different IT depts then this could soon become be a problem.

To me IPSEC looks like be the better solution using SecurID tokens (one time 
passwords) to authenticate users, any thoughts would be appreciated.



 

BBCi at http://www.bbc.co.uk/

This e-mail (and any attachments) is confidential and may contain personal 
views which are not the views of the BBC unless specifically
stated.
If you have received it in error, please delete it from your system. Do not 
use, copy or disclose the information in any way nor act in
reliance on it and notify the sender immediately. Please note that the BBC 
monitors e-mails sent or received.
Further communication will signify your consent to this.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html