Importance of WIDS/WIPS (Wi-Fi Masterminds)

Posted May 4, 2009
Filed under: Interviews, WIDS / WIPS, Wireless Security | Tags: intrusion detection, intrustion prevention, Wi-Fi Masterminds, WIDS, WIPS, wireless intrusion detection, wireless intrusion prevention |

This is the first in a series of posts that I am dubbing “Wi-Fi Masterminds” (TM). I will ask questions to a series of panelists and they will answer in round-robin fashion, where they can answer the question as well as respond to others.

If you have ever seen the show “Around the Horn” on ESPN, that is the type of interaction I am looking for.

I am planning on a pool of 6-8 masterminds, bit will limit each question to a panel of three members. I will try to minimize my own involvement in the questions to only provide structure where needed or correct any factual errors.

Without further delay, let’s meet today’s panelists, shall we? They are…

Jennifer Huber CCNP, RFID+, CWNE #51 @jenniferlucille — Jennifer has over 8 years of experience in the networking and wireless engineering industry. She has a solid background in supporting, designing, deploying, and troubleshooting 802.11a/b/g/n Enterprise wireless installations, as well as the ability to take complex information and explain problems and solutions in terms that are easily understood.

Keith R. Parsons, CWNE #3: – @keithparsons http://WLANiconoclast.blogspot.com — A gifted presenter, Keith is known for his wit and broad technical expertise. He holds over 50 technical certifications and has earned an MBA from the Marriott School of Management. He is author (or editor) of a dozen technical publications and has developed seven technical certification programs. He travels throughout North America, Europe, Africa, Asia and Australia in behalf of a wide variety of IT vendors, explaining networking technology to industry professionals.

Joel Barrett, CWNP#6: @joelbarrett — Joel Barrett is a senior-level wireless networking architect with Cisco Systems. Joel consults primarily with large enterprise customers concerning complex wireless deployments. He is an author of wireless industry books and lexicographer for “The Official CWNP Dictionary of Wireless Terms and Acronyms”.

I asked the panelist the following questions:

How important do you think wireless IDS/IPS functionality is in an enterprise WLAN? What do you think are important features of wireless IDS/IPS systems?

Here is what they had to say…

Jennifer: The need for robust IDS/IPS alerting is essential in enterprise WLANs used in environments where the security of WLAN data is of import, or may be required by law. Generating a baseline of WLAN usage, and implementing periodic auditing could mitigate the impact of a data breach, or prevent a repeat of the 2007 T. J. Maxx data theft incident. Implementing a WIPS/WIDS system is usually one of many steps toward HIPAA or PCI compliance. The ability of the WIPS/WIDS system to determine if a rogue AP is connected to the enterprise network is especially beneficial when determining the real threat of the rogue device.

Keith: I agree with Jennifer’s initial description of the value of a wireless IDS/IPS system. I too have noticed the initial value of a WIDS is in the area of security. Being able to configure the correct security alarms for the intrusions your company cares about is paramount. A WIDS straight out of the box will give hundreds, if not thousands of alarms. The first step should be to correctly choose and configure the alarms your firm cares about tracking. Then build the proper response to those alarm triggers, i.e. document the remediation process for each alarm. As you clear each alarm category, then slowly add more alarms to the WIDS system until you get to where your firm wants to be.

In my clients, they purchase a WIDS for security – but then received the best ROI based on the performance alarms and learning to better adapt the performance characteristics of their Wireless LAN – thus getting double, triple or higher throughput increases. Yes, the security is important, but a great WIDS/WIPS should also help you to troubleshoot and ‘tweak’ your Wireless LAN as well.

Joel: Wireless IDS/IPS is important because, for any establishment that accepts credit cards, PCI DSS compliance requires it. Customers who don’t accept credit cards should still implement WIDS/WIPS so they are aware of security threats and can take steps to reduce or eliminate rogue devices. In my opinion, it is more important to do continual monitoring rather than just periodic monitoring, as required by PCI DSS.

The most important feature, after detecting rogues, is the ability to produce meaningful reports so that management can understand what needs to be done to properly, quickly, and legally deal with those rogue devices.

What do YOU think? Let our panel know by submitting a comment!

DanTheManCan on May 6, 2009

Awesome post Douglas. I normally don’t read things like this, but i really like the format you went with. Great job

Reply
Wade Williamson on May 13, 2009

Hi guys,

Just as a bit of disclosure, I work for a vendor of WIDS/WIPS solutions (AirMagnet) so I have an obvious bias, but I think that this is a great topic so I wanted to pitch in my two cents.

What we are really talking about when we say wireless IDS/IPS is a stateful analysis of the airspace. In a wireless LAN, there are no true chokepoints between the outside world and our end-users. In a wired network we of course have layers of firewalls, IDS/IPS, border routers etc, that monitors traffic to and from the outside. We don’t have this chokepoint in a wireless network – our end-users can accidentally connect to a neighboring AP or evil twin. Hackers can directly probe for weaknesses, or attempt to spoof approved users. The overarching issue is that the air itself is the only place where you can be sure of seeing all the traffic and activity that impacts the security of your network. It is the job of wireless monitoring systems to provide the stateful analysis of all of this traffic to determine who is talking to whom, where the vulnerabilities are in the network, where you see the signs of attacks or hacking tools, and also whats going on in terms of the performance of the network. In short, the air itself is the boundary between your world and the outside world and just as in your wired network that boundary requires direct, full-time monitoring to keep things safe.

Reply
Personal Pre-Shared Keys (PPSKs) – Super Tuesday Poll « WiFi Jedi.com on June 9, 2009

[…] The Importance of WIDS/WIPS (Wi-Fi Masterminds) […]

Reply