U.S Privacy Breach Laws (week 4)

Having worked for an MSSP (Managed Security Services Provider), I had the privilege of interacting and working with many different clients from different industrial sectors. Each organization depending on the sector they fell under had different reasons for signing up with the MSSP. Even within the same sectors, the different organizations had different drives as to why they needed an information security company to partner with them. We would get the security focused kind to the ‘check-box’ kind, but what was common across board was that for most, the decision was somehow beyond their control and due to regulation, they had to have some security controls in place to avoid being in violation of whatever regulation they fell under. Currently, I work for a financial institution and I now understand how powerful the audit team within the company is. The financial sector is one of the most heavily regulated industry with healthcare being the other ‘unlucky’ candidate and seeing first-hand the pull or push regulators have, I now have a new-found appreciation of why audit is so much revered or avoided depending on when the project deadline is due.

That said, for this week I would like to talk about U.S. privacy breach laws.

You may be wondering how this relates to cybersecurity. You may be asking yourself “…I thought as a cybersecurity professional, the focus would be catching the bad guys?” Well, for one, both IT security and audit teams within an organization need to be aware of their State’s data privacy breach laws in order to avoid any nonconformity to compliance requirements which may mean financial penalties and other legal ramifications. When the business gets impacted (negatively), all business units feel the pain, and this includes IT and Information security. Another thing to also note, is that IT or cybersecurity strategy should always align with the business strategy so if regulators ask the business to abide by some rules and regulations, the IT team should be also mapping out ways of meeting those requirements.

Back to U.S. Privacy Breach Laws

Security breach laws typically have provisions regarding who must comply with the law (e.g., businesses, data/ information brokers, government entities, etc.); definitions of “personal information” (e.g., name combined with SSN, driver’s license or state ID, account numbers, etc.); what constitutes a breach (e.g., unauthorized acquisition of data); requirements for notice (e.g., timing or method of notice, who must be notified); and exemptions (e.g., for encrypted information) ("SECURITY BREACH," 2016). Companies should therefore review their data privacy, data security and incident response policies and procedures to not only keep up with requirements, but also any changes that may be made to the State laws. Some of the laws may require a company to be compliant even when not located within the confines of the State. A good example is with third-party service providers who may handle PII data on behalf of their client. This means those vendors are required to adhere to the laws regardless of where they are located. The organization needs to ensure the vendor also implements security measures appropriate to the size, scope, industry and purpose of use of the information collected are implemented and maintained (Halpert & Anderson, 2015).

Another example of how different laws change is with HIPAA and ePHI. Due to the technological advancements under HIPAA, we have ePHI (electronic Protected Health Information) which covers “individually identifiable” “protected health information” sent or stored electronically. Doctors now are using mobile devices and electronic devices to review patient records and even share this information with other medical providers. ePHI dictates how this information can be handled. The HIPAA Ombibus rule defines this transitive chain of possession such that all businesses that may come into contact with ePHI are made responsible for the privacy and security of that information.  This includes many companies that previously had no idea they had to be HIPAA compliant. This shows that all businesses need to be aware of what laws or regulations apply to them even if not directly. The HIPAA Omnibus rule is one such rule that traverses supporting companies and has far reaching consequences if the 3^rd party providers do not abide by those mandates.

In conclusion

Due to the rampant data breaches that have occurred over the years attributable to the advancements in technology, in the period between 2006 and 2009, forty-seven states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands enacted legislation requiring private, governmental or educational entities to notify individuals of security breaches of information involving personally identifiable information (PII). The three States that do not have security breach laws are Alabama, New Mexico and South Dakota. It is important for us, as security professionals, to be conversant on what legal requirements bind our industries based on the areas of operation. We may be called upon one day by senior leadership to explain some of these requirements and staying ahead of the curve can come in handy when that time comes.

References

Halpert, J., & Anderson, M. J. (2015, July 20). Data Protection, Privacy and

     Security Alert (US). Retrieved September 9, 2016, from DLA Piper website:

     https://www.dlapiper.com/en/us/insights/publications/2015/07/

     state-breach-notification-laws/

SECURITY BREACH NOTIFICATION LAWS. (2016, January 4). Retrieved September 9,

     2016, from National Conference of State Legislatures website:

     http://www.ncsl.org/research/telecommunications-and-information-technology/

     security-breach-notification-laws.aspx

Internet of Things Overload (week 3)

The Spanish-born American philosopher, George Santayana wrote in his book titled “The Life of Reason”, 1905 that those who cannot remember the past are condemned to repeat it. Time and time again we have seen this school of thought proven true. If we look at it from a social perspective, pick fashion for example; how many times have we ‘brought back’ a style that was the ‘in thing’ back in the days? Plenty of times, I would say. While this is not necessarily a bad thing, it just shows that humans are somehow wired to repeat things. Apply this human nature to computing and information security and we see the same type of threats being resurrected from the ‘dark web cemetery’ and lo and behold! We always get a ‘Gotcha moment’.

Last year, right about this time, I wrote a blog about Botnets and the Internet of Things. The post talked about Conficker and how its logic had a mechanism for seeking out new domains on a daily basis; by mid-2009, Conficker spread to over 10 million computers (Singer, 2011). Fast forward to October, 2016; a DDoS attack began creating problems for Internet users reaching an array of sites, including Twitter, Amazon, Tumblr, Reddit, Spotify and Netflix. Researchers pegged the blame on hacked “Internet of Things” (IoT) devices, such as CCTV video cameras and digital video recorders (Krebs, 2016). This massive DDoS attack was attributed to a malware dubbed ‘Mirai’ (Japanese for ‘the future’), a name that seems to suit the MO of the malware; locate and compromise IoT devices to further grow the botnet and launch DDoS attacks. Mirai scanned the Internet for devices that were not secured; those that still used default user names and passwords and by employing a dictionary attack against those devices with a pre-configured list of default username/password combinations, was able to compromise and take over those devices (Herzberg, Bekerman, & Zeifman, 2016). 

Image Courtesy of ReadWrite.com

We can now see the trend and why George Santayana’s statement is true even for computing and information security. We’ve all seen those pesky reminders setup by IT to change our passwords every so often. Do we receive those messages with joy or view them as just another nuisance from those IT fellas? I bet most of us hope they would stop reminding us about those damn passwords. 

Most issues we observe in today’s cyber world are simply reincarnations of old threats that were existent before and the same mistakes or vulnerabilities that propagated those threats are the same ones, although slightly modified, plaguing us again. An attack could be different in that there is a variant but the core of the attack or what makes it possible most of the time remains the same. Case in point, use of default passwords in devices making it easy for a malware code to perform a brute-force attack against the device successfully.

Question therefore is, why then would IoT manufacturers not step up their game and secure their appliances?

The answer of course is the good ol’ connectivity vs security battle. IoT manufacturers are focused on getting products to market as fast as possible with their priority being connectivity and not security. Market demand and profits associated with these demands are driving decisions and the manufactures are okay with dealing with security implications down the line rather than incorporating the measures at project kick-off.  The IoT realm being relatively new also makes the decision fall on the manufacturers as there are no set standards of what the security landscape should look like for those devices. We have a situation where the product manufacturers determine the appropriate trade-offs for themselves without any best-practice references.

My take on this lack of, or poor IoT security configuration, is that eventually the market and possibly regulators will arm twist the manufacturers into incorporating more solid plans that ensure their products are somewhat secure and the public is not victimized due to negligence on their end, as observed in the case of the Mirai related DDoS attacks. We all love our smart products and the luxury they afford us but if it means compromising our privacy and security, some consumers may opt to roll back to the stone age days where we wrote down our grocery lists on paper instead of the refrigerator sending us a text. I guess the devices aren't as smart as they purport to be after all :)   

References

Denning, T., Tadayoshi, K., & Levy, H. M. (2013). Computer Security and the Modern Home. Communications Of The ACM, 56(1), 94-103. doi:10.1145/2398356.2398377

Herzberg, B., Bekerman, D., & Zeifman, I. (2016, October 26). Breaking Down
     Mirai: An IoT DDoS Botnet Analysis [Blog post]. Retrieved from Imperva
     Incapsula website: https://www.incapsula.com/blog/
     malware-analysis-mirai-ddos-botnet.html

Krebs, B. (2016, October 21). Hacked Cameras, DVRs Powered Today’s Massive
     Internet Outage [Blog post]. Retrieved from KrebsonSecurity website:
     https://krebsonsecurity.com/2016/10/
     hacked-cameras-dvrs-powered-todays-massive-internet-outage/ 

Singer, P. W. (2011, October 21). Mark Bowden’s “Worm: The First Digital
     World War”. Retrieved February 7, 2016, from https://www.washingtonpost.com/
     entertainment/books/mark-bowdens-worm-the-first-digital-world-war/2011/08/30/
     gIQAwcKO4L_story.html 

He Say She Say ...The Quest for Credible Information

There’s a running joke for students working on assignments; “if you do a Google search and you need to click on the 2^nd page, you are in trouble”. This concept is further emphasized by digital synopsis with their joke; “The Best place to hide a dead body is page 2 of Google search results …or page 1 of Bing”. While these statements are merely jokes, they do have some truth to them and I for one rarely click on page 2 when looking up information on the Internet. Maybe my searches are just specific and I get what I need on page 1 or Google has enough analytics on my preferences that the results returned fit my profile to a T …I will go with the latter. What many people don’t know is that some of the results returned usually don’t necessarily hold the truth we seek and Google is simply ‘serving’ them to us in the order of paid services (in the case of ads) or simply what people are ‘chatting about’, aka what is popular or being clicked on the most.  

Image Courtesy of Designzzz:
Ref http://www.designzzz.com/albert-einstein-quotes/

"The Famous Quote"

We’ve all run into the famous quotes by well known, established individuals, the likes of Einstein and Lincoln. Most of these quotes weren’t even quoted by the authors attached to them; a little Photoshop magic and voila! …we have a winning quote. Not all that is published on the Internet however is fabricated. Before the Internet morphed into the ‘beast’ it is today, people would for example, go to libraries and use published books for their research or they would reach out to subject matter experts like professors for guidance. All these information is now available in the digital space and while it co-habits this space with a lot of other ‘junk’ information, credible information can still be found and used for our day to day research and knowledge adventures.

For this blog post, we will focus on how to identify credible sources of information for threats, vulnerabilities, updates, and security news in general. 

My ‘primary’ go to resources however, are as follows:

National Institute of Standards and Technology (NIST): NIST is an agency of the U.S. Department of Commerce. It publishes security standards and guidelines plus other security-related information that can be used to support decisions by individuals all the way up to industry and government. If you are looking for a ‘how to guide on securing your home wireless network’, NIST will have it. If it’s a business thinking about ‘how to protect their confidential data’, NIST has that too.

National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE): If I want to know what vulnerabilities exist on my system, my two go to resource are NVD (sponsored by DHS/NCCIC/US-CERT) and MITRE’s CVE. both these sites provide valuable information on known vulnerabilities with recommendations on how to mitigate them.

SANS Internet Storm Center and United States Computer Emergency Readiness Team (US-CERT) both provide up to date news and advisories for most computer security topics. If you want to know about the latest patch, security news, bulletins, or a security update; both of these resources are credible.

Other than the resources mentioned above, I also use Information Technology & Security websites that publish peer reviewed articles. Packet storm security for example provides information on exploits, advisories, tools and whitepapers on various cyber related topics. CSO Online, Dark Reading, How-to-geek and many more provide useful information, tips and tricks and just general cyber-related information. Bloggers like Lenny Zeltser or Krebs on security are also credible and their posts can be used as resources given their expertise in the cyber realm. 

In conclusion

There are plenty of credible resources of information out there and this blog would not be enough to list them all out. When looking up information, we should not trust everything presented to us without verifying the source and backing that information up with other sources. Timelines and who wrote the article also matter; some authors hold more weight than others by virtue of being subject matter experts in their processional fields. Outdated articles may lose credibility due to changes over time; an issue that was critical 10 years ago, may not be viewed the same today. When you have a conflict of information, evaluate the sources and use the aforementioned logic; at the end of the day we can always learn from our mistakes …even misinformation.  

As a footnote, while I agree that Wikipedia should always be taken with a grain of salt, I think it does provide some basic information that can be useful in quickly determining definitions and finding well known information. For example, if you want to know what service runs on a given port based on a firewall report you just received, wiki could come in handy. However, an alternative and more credible source for that scenario would be IANA (Internet Assigned Numbers Authority). If there was a conflict in information between those 2 resources, IANA would take precedence over Wiki given IANA is an authority when it comes to protocol addresses and Internet Architecture. 

Current Trends in Cyber-security (week 1: Intro)

This blog came about from a class I took (CIS 608 – Information Security Management) at Bellevue which had a requirement that students maintain a blog throughout the 12-week course. For purposes of the class, students were required to write at least on blog each week and the topic would be anything the student fancied; so long as it had some relevance in the Information Security realm. While the blog was to be maintained during the course, the professor’s recommended students to keep posting blogs beyond the 12 weeks as the goal behind the blog was more than to simply get a passing grade for the class. If you were to do a Google search for blog (inurl:blog) you get 551 million results and if you narrow your search to information security blogs (inurl:blog inurl:information security), the results decrease to about 44k; this shows the prevalence of blogs on the net. Unfortunately, I did not drink the kool-aid as prescribed by the professors and have not posted much since my last class. Just like many of my classmates (I believe) sometimes life takes a hold of many things and the work-school-life balance evades us.

Blogs are a way for people to express their views and share their thoughts with the world and in most cases, indulge in debates through comments. I for one have found blogs to be a tremendous source of information especially when writing papers for class and researching work related tasks and projects.  

Figure 1: courtesy of reddit.com (stack overflow)

Figure 1 (courtesy of reddit.com) shows how much information posted on the Internet helps out a lot of students, and the work force too. Many a times, I have been stuck working on an assignment or a project and through simple online searches, I find the information I need. The purpose of this blog is to mainly share thoughts I may have on a topic and in essence, help out anyone out there who may be scratching their head because of the issue; no need to re-invent the wheel, we are all in this together.

Just recently I was faced with the ‘tough’ decision of renewing my anti-virus subscription. As trivial as that sounds and without getting into too much debate on which one is better than which (it’s a preference thing in my opinion), I found multiple blogs providing some insightful views. It is my goal and hope that the topics I post on this blog will provide some guidance to someone out there especially when it comes to information security. The materials will (and should) be backed up by references from industry experts whose opinion will provide that extra nudge when conveying a thought.

So, who am I anyway?

I consider myself to be your regular chip off the old block lad who is just passionate about information security and is always on the lookout for the next ‘fancy’ attack vector. I actually never started out wanting to venture into the information security domain (maybe because I didn’t know about it). I was more inclined into networking and more IT leaning, but after being introduced to security, I was sold. Yes, it sounded like it would be straight out of the War Games script and my blood started racing thinking about it, only to be met with logs …they never told me I would be looking at log-lines. Sigh!

My first information security job was with an MSSP and as an analyst, we would review logs and events and report those anomalies to clients. While the job sounds boring and mundane, I did learn a lot from doing it. I believe every security professional needs to have some log analysis know-how; we all need to put in log analysis time before we move on to the ‘sexier’ red team Vs. blue team exercises as depicted in Mr. Robot (if you haven’t watched it... please do).

I consider myself to still be a rookie in this industry and appreciate the vast opportunities and career paths that it affords us. In addition to a bachelor’s degree, I have 2 certifications both from CompTIA (Sec+ and CASP). I am all for certifications but also against it when it is simply done to advance career-wise, without the recipient fully grasping the concepts; everyone wants to have knowledgeable colleagues after all. I am currently pursuing my Masters in Cyber-security and after that, I will tackle another Certification or 2 based on the role(s) I will have for work by then.

I truly hope my blog will make an impact in your security life and at the very least help you get an idea on how to tackle that assignment that is due in an hour.

Encryption (week 11)

Image courtesy of plus.maths.org

Ever since written communication was developed, humans have always tried to hide, conceal, or scramble sensitive information from prying eyes. Julius Caesar had his scheme where characters were shifted a certain number of positions to scramble the message and this was dubbed the Caesar’s cipher. For this to work the recipients had to know what the count was for the shift. This method is of course very easy to break with the current technology. During world war 2, the Germans had the famous (or infamous depending on what side you were on) encryption device named Enigma. This machine was used by the Germans to encrypt their messages and the way it worked was by providing substitute characters for the letters entered by the operator. The only way this message could be decrypted was through the possession of an enigma machine. When speaking about the Enigma, the name Alan Turing also has to be mentioned as he pioneered the cracking of the Enigma and this changed the course of the war and perhaps the future of the world.

On February 20^th of this year, Linux Mint was breached and hackers were able to point users to a compromised ISO (drive image) that was a modified version of the 17.3 Cinnamon (Linux Mint OS). This version allegedly has a backdoor according to Linux project leader, Clement Lefebvre’s post on the Linux Mint Blog. This is a classic case of awareness and using the available tools to ensure that you are downloading the safe versions of software. By verifying hashes, we can be able to know if a software version has been tampered with.

From the real world affairs to the digital landscape, encryption touches 2 of the 3 aspects of the CIA (Confidentiality Integrity and Availability) triad; confidentiality and integrity. Confidentiality is the process of ensuring that information is only exposed to individuals who are authorized to view that information. There are different methods that can be employed to ensure that this comes to fruition, one way is through policies such as training and awareness of the users, classifying the information based on the level of risk to the business were it to be exposed, and a through technical controls like encrypting this information. Integrity on the other hand is the process of ensuring that data is not tampered with; it involves maintaining the consistency, accuracy, and trustworthiness of the data over its entire life cycle. 

For both confidentiality and integrity, the data may be at rest for example stored in hard drives, tapes, databases etc., in transit meaning that it is traversing the network for example emails being sent, files being transferred, and the last state that data can be in is in use which is data that is in memory and being processed. All three data states need to be secured and encryption is a method that can be used to achieve this security control.

Other elements of security that encryption provides is authentication and this is when the origin and originator of the message can be verified. Non-repudiation is also achieved through encryption and this is when the sender of the message cannot deny sending the message. The way encryption achieves this control is through digital signatures. Before technology, official seals were one way of authenticating the letters sent from for example a business or government agency. In the Internet world, digital signatures are used to perform this task. One key area where digital signatures are common is in software signing. When you download software over the Internet, how do you verify that this is legitimate software from the true publisher for example Microsoft? Digital signatures. The software publishers provide the public with a hash which is a representation of the entire contents of the software posted on their site. If any modifications are made to the software, the hash value would change and the end users can know that there has been tampering therefore the integrity of the software has been compromised. 

Although enforcing encryption controls may be cumbersome to the business or even our home systems, it adds an extra layer of protection for our data. Encryption helps to protect the data against physical threats as well; if we lose our devices, it’s hard for the adversary to read our sensitive information if the files or hard disks are encrypted.  

References:

http://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA

http://searchsecurity.techtarget.com/definition/digital-signature

http://www.engadget.com/2016/02/22/hackers-compromise-linux-mint-iso/

http://blog.linuxmint.com/?p=2994

https://plus.maths.org/issue34/features/ellis/enigma_in_use.jpg

Privacy Over Security (week 10)

Image courtesy of www.pewinternet.org

After 9/11 2001 the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (aka USA PATRIOT Act) was passed by the legislative wing of the government. What this act did was provide a significant increase in the surveillance and investigative capabilities of law enforcement agencies within the United States and the intention was to ensure that there can never be a repeat of 9/11 on American soil. This act had the right intentions and at the time it was passed, the whole Nation was speaking in unison; “we must get them” and “never forget” were some of the themes.

According to the epic.org article titled USA Patriot Act, under surveillance and privacy, there are three major laws that do not provide many of the protections that were associated with the Federal wiretap statute (in place before the Patriot Act).

The Title III which requires probable cause and approval from a judge before conducting real-time interceptions.

Electronic Communications Privacy Act (ECPA). This act governs how law enforcement can access stored email and other electronic communications. The act states that the use of intercepting tools requires a court order but no probable cause and the court must authorize the surveillance upon government request. That statement shows just how vague the controls or checks and balances are when it comes to electronic surveillance. The court order is just a formality.

Foreign Intelligence Surveillance Act (FISA). This act authorizes the government to carry out electronic surveillance after obtaining a court order that authorizes the surveillance and the only probable cause that they need to provide is that the person of interest is acting as a foreign agent and this applies even to American citizens.

There are many other acts within the Patriot Act that give law enforcement even more authority to intercept, collect and even store private information that they obtain through the use of advanced surveillance tools in the name of National Security. The extent of these surveillance programs within the United States was made public by Edward Snowden who leaked information about how the National Security Agency collected electronic information. Snowden received both support and criticism. His revelations did however lead to more debates on how much privacy are we willing to give up in order to stay secure. The civil liberties and privacy protections that have been part of America and that the constitution dictates are slowly eroding. If you are a proponent of security, your opinion is that security will always trump privacy and we should be willing and expect to lose some of these liberties if we expect to be safe.

The biggest privacy issue this week is of course Apple vs FBI. The FBI are trying to get Apple to create a backdoor that will enable them to crack the deceased gunman Syed Rizwan Farook’s iPhone as they try to access it to get information that may help them with their investigation. Farook was involved in a terrorist attack that killed 14 people in California late last year. As a security feature, Apple iPhones are built to wipe all data after the password is entered incorrectly too many times which makes it popular with companies as they can protect their intellectual property in cases where employees lose their phones. The FBI’s brute forcing attempts must have hit a roadblock and now they are asking Apple to intervene (through a court order). Apple’s argument for non-compliance is that they are not comfortable sharing how to by-pass the security feature with law enforcement as they do not know what their reach will be after they gain the know-how.

“The government is asking Apple to hack our own users and undermine decades of security advancements that protect our customers — including tens of millions of American citizens — from sophisticated hackers and cybercriminals… The government suggests this tool could only be used once, on one phone. But that’s simply not true. Once created, the technique could be used over and over again, on any number of devices.”

-        Andrea Noble - The Washington Times – quoting Apple CEO, Mr. Cook

The courts already ordered Apple to comply but they are still resisting and have appealed to a higher court. I would not be surprised if Apple took this all the way to the highest court in the land; they certainly have the means. Protests are already planned with anti-surveillance groups planning to let the FBI know how they feel about their request. This is a contentious issue given that the phone that needs to be back-doored belongs to a confirmed terrorist and not a suspect. In my opinion I think Apple will be forced to give in. They may have a condition in place like not being required to share how they did it but you never know, the FBI might get that too. I am curious if Apple’s decision is truly based on its support of privacy or this is just a marketing ploy to rally the masses to their products as they come out of this fight as ‘champions of their customers’.

Whatever side of this topic you may be on, the fact is, times are changing and we will always have this issue hover over us as long as electronic communication is still around. You try to install an app and you are supplied with a terms of agreement. For the application to function, you need to allow it to access different things on your device. When browsing the web, you have cookies that track your every move and if you were to turn these feature off, you would probably not be able to experience the web the way we do today. It seems like everything we do on the web requires some form of loss of privacy.

The debate still rages on; are we willing to sacrifice one over the other? ... because we cannot get both at the same time.

References

https://www.epic.org/privacy/terrorism/usapatriot/

http://www.washingtontimes.com/news/2016/feb/21/apple-justice-extend-fight-over-iphone-privacy-vs-/

http://www.washingtonexaminer.com/the-security-vs.-privacy-debate-is-already-over-and-privacy-lost/article/2545407

Wireless Communication (Week 9 Blog)

This week in my Ethical Hacking and Response class we will be presenting a group project and the topic of discussion is Wireless Hacking. I thought it would be a good topic for my blog post this week. First off I would like to throw in a breach that happened back in 2006.

TJX Companies: 2006. 94 million credit cards exposed. Hackers took advantage of a weak data encryption system and stole credit card data during a wireless transfer between two Marshall's stores in Miami, Fla.

“After the TJX breach came to light, one of the questions posed by security experts was: Why are businesses still using WEP?” (Schwartz, 2011 – darkreading)

Let’s briefly touch on a few areas that wireless technology is used:

Voice Communications - cellphones

Remote Control and Monitoring – TV remotes, garage openers, wireless dog fence (cruel), infrared sensors, surveillance videos, heart rate monitors

Remote Measurement and Wireless Sensing – Utility companies can now remotely read your meter

Item Tracking – Think Radio Frequency IDentification tags

Entertainment – wireless speakers, headphones, microphones, home theatres

Navigation and Location – Global Positioning Systems (GPS)

Quality control and Risk Management

Networking – PAN, LAN, WAN, Cellular Networks

Energy Management and Wireless Power Transfer – charging docks

Wireless technology has come a long way and it is freeing existing good ideas from the constraint of wires and, at the same time, enabling an emergence of new ideas and applications that weren't possible before. The list above shows that wireless has played a major role in advancing some technologies that are now part and parcel of our day to day lives, but just like with every good thing, there seems to always be some cons.

“The wireless security market has matured significantly in the past several years, but still many organizations remain vulnerable to attacks, either through legacy protocols with well-published deficiencies, or through new threats that are not adequately addressed”

 – Joshua Wright, SANS

With wireless networks, its biggest flaw is the hardware that is used; the routers, modems etc. A common attack vector for wireless communication is wireless driver attacks. In this type of attack, rather than going after the wireless networks themselves, an attacker will choose the path of least resistance by going after the hardware. Exploitable vulnerabilities in wireless drivers have been discovered in all major wireless card manufacturers. When I looked up the word wireless under NVD (National Vulnerability Database), it returned 359 matching records

So how do we secure wireless communication?

The answer is through the combination of a Strong Encryption Method and a Strong Key/Password

Image courtesy of howtogeek.com

Key Encryption Methods are as follows

WEP (Wired Equivalent Privacy) – in this system, the same shared key is used for both authentication and encryption. With the shared key, the attacker can decrypt frames or pose as a legitimate user. WEP can be easily broken and is no longer recommended.

WPA + TKIP: Wi-Fi Protected Access + Temporal Key Integrity Protocol

WPA TKIP was meant to replace WEP but it is now considered unsecure. TKIP uses the RC4 stream encryption algorithm as its basis and it encrypts each data packet with a unique encryption key, and the keys are much stronger than those of WEP.

WPA + TKIP/AES: Wi-Fi Protected Access + Temporal Key Integrity Protocol/ Advanced Encryption Standard.

AES uses symmetric-key algorithm (same key for encryption and decryption). AES is considered secure and is used by many government agencies. In this encryption method, the TKIP enables compatibility with legacy devices that don’t support AES but this also opens up the network to attacks since the low hanging fruits always get hit first.

WPA + AES – this one just removes the TKIP portion so it’s safer than the latter

WPA2 + AES – This is the most secure and should be used in wireless communication setups. It utilizes keys that are 64 hexadecimal digits long. Note that this method can be cracked too, but it will take too long for any attacker so the incentive to actually commit resources for this ‘mission’ may not be there for most wireless networks. There are other avenues of breaching your network that are less time consuming like sending a phishing email.

Summary

Wireless communication has benefited a lot of people and is helping make life easier and with the growing trend in Internet of Things, despite some of the weaknesses associated with it, it is not going anywhere. As users we should always be vigilant of our surroundings (beware of ‘free/open’ networks) and when setting up wireless networks, we should ensure that we adhere to security best practices by using the most secure encryption method (WPA2/AES) and making sure that the key/password is strong enough. Also make sure that defaults are changed. Leaving the devices’ default settings will make it as simple as opening a browser and typing in ‘router passwords’ and you are presented with a list of all the default user names and passwords for all kinds of router makes and models.

Stay safe while you connect!

References:

https://web.nvd.nist.gov/view/vuln/search-results?query=wireless&search_type=all&cves=on

http://www.darkreading.com/attacks-and-breaches/wardriving-burglars-hacked-business-wi-fi-networks/d/d-id/1100324?

http://www.howtogeek.com/204697/wi-fi-security-should-you-use-wpa2-aes-wpa2-tkip-or-both/