Weak Defense...But Getting Better

The latest update in our rolling feature on wireless security: Jan. 12, 2005: This articles describes concerns and best practices for wireless security and is periodically revised. Worried about your wireless network's default security? You should be. Wireless networks send their data through walls and ceilings, and can be picked up with sensitive antennas -- much more sensitive than the ones your equipment uses -- miles away. With this kind of transparency, you need to protect the data on your network, even if you're a casual home user. The only tool for consumers and small businesses until mid-2003 was the built-in WEP (Wired Equivalent Privacy) encryption that's required as part of the Wi-Fi certification program. But security experts have shown numerous flaws in WEP that prevent it from providing even a minimal reliable level of security for serious applications. Recent tools show that WEP can be cracked in just a few minutes on a busy network. Businesses had a strapped-together system they could use called 802.1X/EAP, but standardization for securing it (a separate problem), missing clients in older machines, back-end server requirements, and its reliance on WEP all prevented initial widespread adoption. That's changed, and is part of this article. Fortunately, in November 2002, the Wi-Fi Alliance, a group trade that certifies 802.11a, b, and g devices as interoperable, released an interim replacement for WEP and other aspects of Wi-Fi security that will change the landscape. This new standard is called WPA (Wi-Fi Protected Access). In mid-2004, the engineering group responsible for wireless standards ratified IEEE 802.11i, the full replacement for WEP and a superset of the features found in WPA; it will be known as WPA2 when certified by the Wi-Fi Alliance in 2005....

panic attack panic attack panic attack panic attack