Far too many Wi-Fi networks remain open to intruders

Responding to research claiming to show that whilst wireless users are now more aware of the need for security, many wireless networks are still insecure, easy-to-use authentication may be a low-cost solution to the problem.

What is interesting about the research from the Wi-Fi Alliance is that 97 per cent of respondents believed that their data on wireless devices and networks is safe and secure.

In fact, as recent developments in the field of password recovery software from the likes of Elcomsoft has shown, even a WPA2 password is crackable. Using the professional version of Elcomsoft’s Wireless Security Auditor software, for example, allows “password recovery” to take place on a computer with up to 32 CPUs and 8 GPUs to crack WiFi encryption using a brute force attack.

Review tests of Elcomsoft’s WSA software have shown the application can brute force crack as many as 103,000 WPA2 passwords per second – that’s more than six million passwords a minute – on an HD5390 graphics card-equipped PC. You don’t need to be a maths genius to work out the repercussions for a supposedly strong eight-character WPA2 wireless passphrase here.

Using longer WPA2 password on WiFi networks is now an absolute must for any company that takes its network security seriously. Other options – including two-factor authentication – should also be moved from the nice-to-have into the must-have security category.

The irony of the fact that many wireless users will be using a smartphone to access the Internet and/or company resources across a WiFi connection is also something that should not go unnoticed as users can also use their smartphone as an authentication device for the same session.

This avoids the need to carry easily-mislaid hardware authentication devices around, whilst at the same time giving users a far higher degree of security than is available using wireless passwords and user IDs/passwords on their own.

In fact, if the underlying wireless network can be compromised by hackers, then the user ID and password can be eavesdropped, along with entire communications sessions, regardless of whether it is email, general Internet surfing or corporate system plus folder interactions.

The Wi-Fi Alliance’s research confirms a lot about wireless user behaviour that security experts have known about for some time. But the fact that wireless access point users are getting sloppy with their password length – eight characters is clearly no longer sufficient – makes a clear case for easy-to-use authentication.

And if that authentication is tokenless, that makes the logon process a lot easier for the user, meaning that even if the underlying wireless connection is not entirely secure, the use of authentication and encrypted VPN technology can make the actual data transmissions far more secure. And that’s a must-have in today’s company information-rich environment.

SHARETweet about this on TwitterShare on LinkedInShare on FacebookShare on Google+Pin on PinterestDigg thisShare on RedditShare on TumblrShare on StumbleUponEmail this to someone

Steven Watts brings 25 years’ of industry experience to his role at the helm of Sales & Marketing for SecurEnvoy. He founded the company with Andrew Kemshall in 2003 and still works tirelessly to grow the company in new and established markets. His particular value is market and partner strategy; having assisted in the development and design of the products, designed the pricing strategy and recurring revenue model that has been so key to the businesses growth and success. Before starting SecurEnvoy, Steven was responsible for setting up nonstop IT, the UK’s first IT security reseller in 1994. Prior to setting out on his own, Steven worked as Sales Director at the networking and IT division of Comtec, and had started his career in office solution sales in 1986.