tailieunhanh - how to cheat at securing a wireless network phần 4

Tham khảo tài liệu 'how to cheat at securing a wireless network phần 4', công nghệ thông tin, an ninh - bảo mật phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | Dangers of Wireless Devices in the Workplace Chapter 3 117 Frequently Asked Questions The following Frequently Asked Questions answered by the authors of this book are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author browse to solutions and click on the Ask the Author form. Q If I enable WEP or WPA won t this be enough to protect my wireless network A No. Although it s a good start and should usually be implemented wireless encryption is flawed and can be cracked using cracking tools commonly available on the Internet. No single action outlined in this chapter should be seen as a complete security best type of approach to security is a layered one one that implements many different levels and types of protection tools. Q Implementing a wireless DMZ with a VPN is too expensive. Are cheaper solu- tions available A Yes. If an enterprise VPN concentrator is out of reach and you still want to lock down your wireless network you can restrict all wireless network traffic to a bastion host or two. Using a firewall you can implement rules so that the only traffic permitted to pass is to a bastion host. Perhaps your bastion host is running only SSH or Remote Desktop. Q Why bother disabling SSID broadcasts if Kismet and other intelligent wireless hacking tools can still determine the SSID A This step is one in a series of steps to protect your wireless network. Remember it will stop potential intruders using less sophisticated tools such as Netstumbler. Q Controlling the procurement process in my organization is not a possible solution. Employees are free to purchase and expense what they like with minimal controls. A This is probably the case in many organizations outside large enterprises. In this case you will need to take a more active approach to find both rogue access points