11 December 2002
To: The Principal Officer
All Insurers
Dear Sir/Madam
WIRELESS LOCAL AREA NETWORK SECURITY ADVISORY
The security vulnerabilities of wireless local area networks (WLANs) have become an issue of great concern as financial institutions are increasingly deploying these wireless data communications systems to provide more user mobility, flexibility and accessibility to their information resources.
2 WLANs transmit and receive data over the air via radio frequency technology. The advantages of mobility and flexibility are being tempered by the presence of security threats such as eavesdropping, unauthorized access, war-driving, jamming and other forms of interception, including physical damage. Depending on how WLANs are installed and configured, such threats can be mitigated or prevented.
3 In today's market, most WLAN products and services support the IEEE 802.11 wireless standard. Several authoritative reports on their security features indicate that they are deficient in a number of areas. These deficiencies, which include static encryption keys of 40 bits, mean that eavesdropping and unauthorised access to these wireless systems are easy and pose a danger to financial institutions which expect and require confidentiality, integrity and authentication in respect of transmitted data and access to their systems. Other significant security issues include the absence of user authentication and poor key management procedures arising largely from the common practice of sharing a single static key among all stations and access points in a 802.11 network.
Recommended security practices
4 If your institution is using WLANs, you should take appropriate measures to ensure their safety and security. Examples of security practices which can be adopted to enhance the security of WLANs include the following:
- Establishing a security policy for WLANs.
- Controlling the use of access points and wireless clients.
- Disabling all unnecessary services on the network.
- Changing the default settings of service set identifiers or internet protocol address information.
- Changing default passwords on access points and wireless routers.
- Turning on the wired equivalent privacy (WEP) protocol function and managing the cryptographic keys properly.
- Using additional security solutions such as VPN tunneling, MAC address verification and user authentication to enhance WEP.
- Deploying firewalls and intrusion detection systems on the wireless network.
- Deploying anti-virus protection on all wireless clients.
- Locating access points and antennas in securable areas.
- Educating users on the importance of protecting their stations from theft, misuse and damage.
Should you have any questions, please do not hesitate to contact me via email or telephone.
Yours sincerely
(Sent via MASNET)
TONY CHEW
DIRECTOR, TECHNOLOGY RISK
MONETARY AUTHORITY OF SINGAPORE
Direct: 6229 9109
Email: tonychew@mas.gov.sg
