Transcript Slide 1

www.airdefense.net
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
What is your Current Wireless Strategy?




Current Policy
 AP Deployment
 Wireless Laptops
 Wireless Printers
 Pilots/Test-beds
 Special Wireless Applications
Official Rollouts
 Number of Sites, APs, Users
 AP Vendor & Management Software
 Authentication & Encryption Methods
 Client Supplicant & Associated Security Features
 Any Mission-Critical Wireless Installations
 Any Tools in Place for Planning or Troubleshooting
Top concerns about security exposures from wireless
Regulatory requirements for network security
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
What Makes Wireless Risky?
Wireless Exposes Your Wired Network
Rogue Devices connected
to the network open doors
for hackers!
Wireless is in every
network & is a shared &
uncontrollable medium
Wireless is an inherently
weak protocol and is
easy to attack
Physical Boundaries Protect your Network
Authorized AP
Rogue AP
Barcode
Scanner
Hacker
Authorized
Station
Confidential Data
Evil Twin
Probing
Laptop
Corporate Network
Hacker
Hotspot
Wireless Hacking Tools
Increasing Sophistication of Attacks
Attack Sophistication
High
Low
2005
1980
Knowledge Required by Intruder
Wireless Intrusions are Happening
A North Carolina Medical
Consulting Firm
Wireless hacking
bust in Michigan
Broke into the computer system of a local medical consulting
 Two Michigan men repeatedly cracked Lowe’s nationwide network
firm & illegally accessed information of hundreds of patients,
from a 1995 Pontiac Grand Prix parked outside a suburban Detroit
including checks and insurance forms
store.
 Charged with penetrating and intentionally damaging a Lowe’s
system.
twins"
 First hopped onto the Wi-FiLONDON,
network atEngland
the store--to"Evil
access
the are the latest
menace
to threaten
the security of Internet users,
company’s central data center
at Lowe’s
headquarters.
experts
in thecrashing
UK are the
warning.
 Deployed hacking software,
in one case
point of sale
An "evil twin" is a bogus base station that latches on to
terminals.
someone using new "Wi-Fi" wireless technology.
Victims think their laptops or mobile phones are connected
to bona fide wireless internet connections.
A Texas County Court
Hackers accessed information filed by the clerk of courts by
using only a laptop & wireless card
Security causes Best Buy
register ban
Best Buy banned the use of wireless
cash registers at its 492 stores after
learning a hacker may have intercepted a
customer’s credit card number.
Minneapolis News Station
BJ’s Wholesale Club
A California Public School District
Unprotected WLAN allowed full unauthorized access to sensitive
files & enabled hackers to upload their own files into servers
Hacked via wireless network at a store location, credit card data was
stolen AND used to the tune of $20M. The lax security found by the
FTC to be an “unfair trade practice”; now under 9 years of probation
and have to institute security measures and hire 3rd party auditorhttp://www.airdefense.net/education/video/
Layered Approach to Wireless Security
Install a 24x7 IPS system to provide protection for:
Similar to wired network security,
wireless networks require layers of
protection to guard against all threats.





Probing Stations
Misconfigured Devices
Rogue Devices
Protocol Vulnerabilities
Laptop Bridging
Hotspot


 Deploy enterprise-class APs
 Enable 802.1x authentication
 Secure data with strong
encryption
 802.11i/WPA2 is preferable
 Install a personal firewall to
protect against viruses, trojans
 Use a wireless security client to
protect against phishing and other
redirection attacks
Expert Opinion on Wireless Monitoring
“Through 2006, 70 % of successful WLAN
attacks will be because of the
misconfiguration of APs or client software.”
“Wireless devices create backdoors for
hackers and can render firewalls, IDS and
VPNs useless.”
WLAN security monitoring is necessary to
keep your enterprise secure
Incorrectly set-up WLANs put the wired
LAN as risk as well”
“Unmanaged WLANs can jeopardize
entire enterprise network, data and
operations”
“New sophisticated security risks continue
to emerge as wireless matures”
Experts Agree on:
1. Rogue Wireless Devices Exist in Nearly All Organizations
2. Wireless Creates Easiest Entry Point for Intruders and Risks will Only Grow
3. Unprotected Wireless Laptops Create Bigger Risk then APs
4. Monitoring is Necessary
AirDefense Solution
AirDefense’s Role in Wireless Security
Guards Your Wireless
Deployments and Areas
without Wireless
Protects End-Users
as They Travel
Authorized AP
Rogue AP
Barcode
Scanner
Hacker
Authorized
Station
Confidential Data
Probing
Laptop
Corporate Network
Hacker
Hotspot
AirDefense Highlights
Focus
Pioneered Wireless Intrusion Prevention Technology & Market
Protection for all wireless devices anywhere including Mobile workers
Innovation
17 Patents Granted or Pending Covering Fundamentals of Wireless
Security; Common Criteria Certified
Growth &
Profitability
Triple digit Compounded Annual Growth Rate; 4 years of Continued
Growth; Profitable and Cash-Flow Positive
Customers
500+ Customers including Market Leaders in all Major Industries and
Government
Partners
Strategic Relationships with Key Industry Leaders such as IBM, CSC,
Symbol Technologies, Trapeze Networks and others
Awards
Won Numerous Industry Awards for Innovation and Growth;
Recommended by Industry Analysts (InfoWorld, Red Herring)
Growing Base of Blue Chip Customers
AirDefense Enterprise Solution Deployed in
35 of 100 Fortune 100 Companies:












Top 4 Global Telecom Carriers
Largest Logistics & Distribution companies in the world with
presence in 200 countries
Major Retailers with hundreds of locations
Global Financial Institutions
Department of
Worldwide Manufacturing companies
Veterans Affairs
Major HealthCare Organizations
Department of Defense (Army, Joint Forces, Navy, DoD)
Department of Homeland Security
Department of Energy (Nuclear facilities)
National Security Agency
FAA, FCC, Treasury, Social Security, Dept of State, Capitol HillUNITED STATES
Major International Airports including the busiest inAIR
theFORCE
world ACADEMY
AirDefense Product Family
Mobile Worker
Security
24x7 Monitoring
& IPS
1
2
 Protect in-building wireless deployment
 Rogue detection, analysis & mitigation
 Policy enforcement & Forensic analysis
 Protect mobile workers as they
travel to hotspots & vulnerable
networks
Sensors
Enterprise Server
Bluetooth Analyzer
WLAN Analyzer
3
4
 Real-time snapshot of local wireless networks
 Locate wireless devices quickly
 Troubleshot and solve connectivity problems
 Monitors airwaves for Bluetooth
devices
 Identity insecure connectivity
AirDefense Solution
AirDefense Technologies: A True IPS System
Wired Network
Switches
AirDefense
Sensors
WLAN Infrastructure
Mgmt Systems
AirDefense Server Appliance
DISCOVERY  DETECTION  ANALYSIS
Remote
Troubleshooting
AirDefense
Personal
AirDefense
Mobile
Protocol
Abuse
Anomalous
Behavior
Signature
Analysis
Alarm Correlation
Other
Sensors
Correlation Across Sensors
Statistical Analysis
- Real-time Live View
of Network
Policy Manager
Automated
Protection
- Wired-side
Suppression
- AirTermination
Historical
Analysis
- RF RewindTM with
Forensic Analysis
Context-Aware Detection Schemes
Some threats &
issues can be detected
at the sensor
Other threats require
correlation across
sensors
Day Zero attacks
require anomalous
behavior analysis
Correlation across
multiple detection
engines reduces false
positives
AirDefense Functionality
Rogue Threat
Management
& Mitigation
RF Rewind with
Forensic Analysis
Mobile
Workforce
Protection
360º Threat
Assessment &
Response
AirDefense
IntelliCenter
Vulnerability
Assessment
AirDefense Advantages







Unprecedented Scalability – 300,000 devices
Identification of True Threats – assessment provided
based on 270 data points minimizes false positives
Reliable Protection – termination methods effective and
highly focused
Accurate Investigations – RF Rewind with minute-byminute detail
Uninterrupted Mobile Worker Protection – users are safe
in the building and at hotspots around the world
Ease of Use – administrators have detailed dashboards
with wizards to help solve problems
Solid & Secure Platform – Common Criteria certified
platform using FIPS 140-2 compliant encryption modules
17
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
AirDefense Functionality
18
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Rogue Threat Management & Mitigation
Calculate Threat Index
Detect Rogue Devices / Associations
1
 Hardware APs, Soft APs, Wireless ready laptops
 Specialty Devices
 Ad-hoc networks/ Accidental/ Malicious
Associations
 NEW: Rogue detection over the wire
without requirement for sensors
 Threat-based Management
 NEW: Two additional rogue on network
detection methods
 Partitioning of Friendly Neighboring
Networks unless they become malicious
2
Highest Risk
Least Risk
Innocent
Neighbor AP
Connection to
Neighbor AP
Terminate Rogue Devices
5
3
Locate Rogue Devices
University of Utah
Health Sciences Center
Connection to
Rogue AP &
transferring data
Analyze Rogue Connections
 Policy-based & manual termination
 Via air or port suppression
 NEW: Follow devices as they roam
4
Rogue AP in
my building
Rogue AP
on My
Network
 Real-time accurate location
tracking of all devices
 In-depth analysis of the activity
level of each rogue
 Who was connected to the rogue
 What/ how much data transmitted
 NEW: 270 forensic details per device
per minute
“What I love about the latest version of AirDefense is its ability to pinpoint if a
rogue is on my network and the ability to do something about it immediately.”
…. provides the peace of mind from knowing that we can identify & eliminate all unsanctioned
laptops, APs, ad hoc networks & application-specific wireless devices.
19
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
360º Threat Assessment & Response
Known/
Known
& Simple
Simple
Attacks
Attacks
Signature Analysis
Network
Correlation
Engines
Anomalous
Behavior
Signature
Analysis
De-Centralized Processing
Protocol
Analysis
Day 0/
Day 0
Unknow
Unknow
n
n
Attacks
Attacks
NEW:
ContextAware
Detection
Policy Engine
ATTACK DETECTED
ATTACK DETECTED
ATTACK NOT DETECTED
ATTACK DETECTED
Collaborative Intelligence
To detect Day Zero/ Unknown/ Sophisticated Attacks, MultiDimensional Detection & Correlation Technologies are Essential
MOST COMPREHENSIVE DETECTION
 200+ threats detected
 Lowest rate of false positives
 Sample Threats
 Reconnaissance & Probing, Various
DoS Attacks, Identity Theft,
Malicious Association, Dictionary
Attacks, Security Policy Violations,
Clear-text Leakage
“First generation WLAN IDS are often limited
to signature-based detection. Just as wiredside IDS could not reliably depend upon
signatures, WLAN IDS will require multiple
detection technologies.”
“…chose AirDefense for their robust
intrusion detection engine that does not
overwhelm you with false positives.”
20
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Automated Policy-Based Active Defenses
Wireless Mitigation
Mgmt
System
 On-command Disconnect
 Policy-Based Disconnect
 Authorization Required, Audit
Trail Maintained
 Mitigation of the right target
due to accurate detection
AirDefense
Server
Switch
Wired-side Mitigation
Public AP
PORT ALERT!
SUPPRESSED!
By
AirDefense
Detected
by AirDefense
Rogue AP on Network
Laptop:
Wired-Wireless
Bridge
 On-command Suppression
 Policy-Based Suppression
 Device Reconfiguration
TERMINATED!
ALERT!
By AirDefense
Detected
by AirDefense
Accidental Association
AirDefense termination methods
are compliant with applicable laws
& FCC regulations
“When a Wireless IDS takes action versus just a detection, that is true prevention ”
“With AirDefense, I sleep well at night knowing that my network is
protected from rogue wireless activity"
University of Utah
Health Sciences Center
21
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Vulnerability Assessment
• Proactively determines which devices/ sections on the network are most
vulnerable and are hence most easy to attack
• Identifies possible attack vectors before they are executed
• Automated report can be used for auditing purposes
• NEW: VA reports can be customized & emailed at user-specified intervals
Summary Report
Wireless
Station Threat
Rogue Device
Threat
Intrusion
Threat
Misconfigurations
Threat
Wired
Leakage
22
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Policy Enforcement & Compliance Reporting
Define




Security
Configuration; VLANs
Performance
Vendor / Channel
Define
Monitor
Closed Loop
Compliance
Monitor
 Compliance with Corporate,
regulatory requirements?
 Network performing
correctly?
Enforce
Enforce
 Turn off SSID broadcast
 Change channel of AP
 Terminate
AirDefense Enables Compliance with
DOD
SOX
DHS
GLBA
FDIC
HIPAA
VISA/CISP
OCC
“AirDefense helps us remain vigilant in securing the network and know our patient data is
not at risk for being sent in clear text, which is a clear HIPAA violation.“
“Enforce policies and put protective measures in place”
23
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Operational Support & Troubleshooting
Remote Troubleshooting
Network Usage & Performance
 Live Streaming View of devices, channels,
bands, networks
 Network utilization over time
 Bandwidth hogs, CRC errors
 Real-time device analysis, tracking, decoding
 Unauthorized channels, data rates
 Full, remote frame capture
 Traffic directional analysis
 Built-in Channel reports for troubleshooting RF
problems
 Connectivity/ Throughput problems?
 Performance degradation analysis
Congestion
Analysis
Availability
 Did any APs go down, who was impacted?
 Notification of lost devices
 Is the network misconfigured?
 Fault Diagnostics
 Automatic discovery of all devices
Traffic
Analysis
“…has been an incredible tool for troubleshooting our network."
… has allowed us to prevent the degradation of performance of our APs allowing
hospital staff to use the wireless network reliably & efficiently."
24
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Mobile Workforce Protection
AirDefense Personal is a small software agent that runs on Windows
laptops, monitors for wireless exposures, and notifies the user and
AirDefense Personal Central Manager.
 Continuous protection for mobile users on the road or at their office
 Ensure that wireless protocols prohibited by your policy are not used
AirDefense Personal
Alert Logs
AirDefense Enterprise
Appliance
Turn OFF
Radio
Policy
Profiles
1. Policy Profiles are centrally
defined & automatically
downloaded each mobile user
2. Alert Logs automatically
uploaded to AirDefense
Enterprise and central
reporting & notification
3. Policy Enforcement
(automatic turn-off radio)
“The best way to prevent this is to download free software from a company called AirDefense.
The software will let you know if someone is trying to rip off your wireless information.”
“Mobile users could get duped by hackers phishing for credentials or other sensitive information
at hotspots and must be protected.”
25
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
RF RewindTM with Forensic Analysis
Min-by-Min Critical Data Store






270 stats per device per min stored
Device Connectivity Logs
Device & Channel Activity Logs
Signal Strength
Data transferred by Type & Direction
AP Traffic Analysis & Congestion History
One-Click Investigation






Were We Attacked?
What Entry Point was Used?
When Did the Breach Occur?
How Long Were We Exposed?
What Transfers Occurred?
Which Systems Were Compromised?
“Forensic analysis is critical to assess damage from a security breach and take proactive steps
for future.”
“That sort of remote access and granular look into suspicious activity simply wasn't
available without AirDefense”
26
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Self-Managing Platform
 Accurate Termination
 Policy based Rules
 Adjustable Views
 Notify by Role, Location
 CiscoWorks WLSE
 Device/Security/DB Mgmt
 Tivoli, OpenView
Easy to Deploy &
Manage
 Secure Sensors (firewalls)
 SSL/Digital Certificates
 Hardened OS
 High Performance
 Zero-Config Sensors
“… offers the only enterprise-class solution for 24x7, real-time monitoring of the airwaves that scales
to support a WLAN deployment with more than 1,000 access points around the globe.”
“Offers ease of management and implementation, and a high degree of flexibility.”
27
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Enterprise-Class Scalability with Lowest TCO
• Scalable

Supports up to 300,000 devices & thousands of
sensors per server

Distributed architecture supports sensors in
hundreds of locations reporting back to a
centralized server
 Easily deployed & reliable

Ships as a preconfigured server appliance & plug&-protect sensors

Primary & secondary fail-over server and selfreporting sensors for system health monitoring
 Centrally-managed

Single web interface for policy enforcement,
system/sensor updates, & system management

Easy to use with dashboards and wizards to
provide role-based views & jurisdictions
 Low bandwidth requirements

Patent-pending optimization algorithms to reduce
the amount of wired bandwidth to less than 3 kbps,
while continuing to maintain full, centralized
correlation and complete security
“… offers the only enterprise-class
solution for 24x7, real-time monitoring
of the airwaves that scales to support a
WLAN deployment with more than
1,000 access points around the globe.”
28
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
IntelliCenter Proving Threat Assessment
IntelliCenter
 Central repository for all intelligence regarding the activity of the wireless network
 Artificial intelligence intended to work like the human brain
 High-capacity and high-speed data storage module – can store upto years of data
 Collects hundreds of statistics for every wireless device at every time interval using advanced
technologies
 IntelliCenter can help correlate thousands of data points across devices and time intervals to assess
any risk or performance issues in real time
 As threats are constantly evolve, AirDefense stays ahead of the threats with IntelliCenter,
ensuring accurate, historically-relevant and context-aware intrusion detection & prevention
270 statistics/ each wireless
device/ every minute
Historically-relevant,
Context-aware IPS
29
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
AirDefense Mobile
Detect  Analyze  Locate
Detects all devices (802.11a/b/g)

Location Tracking
 Device Inventory & Connection Analysis

Live View for Traffic Analysis
 Threat Detection & Alarm Expert Help

Diagnostic Tools for Troubleshooting
 Real-time Reporting

Device Count
Runs on Windows XP platform
Integrated with AirDefense Enterprise

Device Tree
Frames & Bytes
Transferred
Import Authorized Device List from
Enterprise to Mobile

Synchronization of authorized & rogue wireless
devices for specified locations

Rogue Device Information can be imported for
problem resolution & device tracking
Signal Strength
Top Devices &
Channels
“AirDefense Mobile allows us to perform security and performance audits to know exactly
what is happening within our wireless domain enabling us to distinguish a rogue connected
to the internal network from a benign one."
30
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Managing Rogue Bluetooth Devices
FEATURES

Monitors air space for Bluetooth
devices & their activities to identify
security vulnerabilities

Runs on Windows XP and 2000
platforms

Versions for Laptops & PDAs available
Device by
Type
FUNCTIONALITY

Detailed Device
Info
Identifies different types of Bluetooth device (E.g. Laptops, PDAs,
keyboards and cell phones)

Provides key attributes of device (E.g. device class, manufacturer
and signal strength)


Illustrates communication or connectivity among various devices
Identifies services available on each device including network
access, fax and audio gateway
"Many of our new company-issued devices are Bluetooth enabled. Although this is a
convenience for many of our associates, there is a risk that sensitive data may be
compromised. AirDefense BlueWatch provides a monitoring solution that we can use to
identify and track how and with whom these devices communicate.”
31
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Customer Example
Defense Commissary Agency (DECA)
 Deployed 802.11b WLAN inventory flow & product shelf maintenance solutions
 To boost productivity and reduce operational costs
PROBLEM
SOLUTION
BENEFITS
 Challenge was to:
 Ensure that there were no rogues in the facilities with no sanctioned access
 To monitor & manage the worldwide WLAN deployment
 600 Remote Sensors reporting back to 7 secure
appliances
 Protects wireless retail applications by identifying
rogue WLANs & impending threats, enforcing
network security policies and monitoring the health
of the wireless infrastructure
Thousands of WLAN Devices
1000 APs
289 Locations, 5 Continents
Centrally Monitored & Managed
At 3 DeCA Regional Hubs
 Enterprise-class, real-time monitoring of the airwaves
 Provided the central management functionality that allowed IT staff to monitor & manage the entire
WLAN from a single location
“… AirDefense offers the only enterprise-class solution for 24x7, real-time monitoring of the airwaves
that scales to support a wireless LAN deployment with more than 1,000 access points around the
globe.”
Kendra Warren, CIO
32
Internal Use Only
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Customer Example
University of Utah Health Sciences Center
PROBLEM
SOLUTION
BENEFITS
 WLAN Environment: Full-service hospital, psychiatric
hospital, research labs & educational facilities
 Web access, E-mail, EMR system access & Office apps.
 Challenge of securing and enforcing multiple policies,
monitoring for network performance & detecting
unauthorized WLANs across multiple buildings
University of Utah
Health Sciences Center
 25 Distributed Smart Sensors reporting back to a single
secure appliance
 Monitor all WLAN activities 24x7, correlate and analyze
the data to provide scalable, centralized management of
real-time rogue detection, policy enforcement, intrusion
protection and health monitoring of the WLAN
 Detected Rogue Wireless LANs & Optimized WLAN Performance to ensure Peace of Mind
 With the network intelligence from AirDefense, UUHSC was able to quickly troubleshoot network
performance issues and maximize their WLAN's ROI
"We are a diverse environment and have many people who want to use their own access points. It's
important for us to ... set them up so they comply with the policies.“
Bo Mendenhall, Senior Information Security Analyst
33
Internal Use Only
Copyright © 2002-2005 AirDefense Proprietary and Confidential.
Summary

Wireless is a business enabler and is a part of every network
AirDefense Secures your Wireless Network
 Unmonitored
wireless networks can
and Protects your overall Security Investment
make the entire network
vulnerable

Lack of policy compliance can result in regulatory liabilities

…enabling mobile
Employees
to Safely Work
Anywhere,to
Anytime
AirDefense
offers
market-leading
solutions
provide visibility and
control of all wireless assets, regardless of location

AirDefense solutions are trusted by the most security-sensitive
organizations in the world

…so You can Take Your Business as Far as it can go!
AirDefense solutions are cost-effective
& provide the lowest TCO
34
Copyright © 2002-2005 AirDefense Proprietary and Confidential.