This is a subject that comes up a lot with my clients. The answer is not as straight forward as it may seem. There are a lot of factors that can effect this. Some of them are as follows:
Your router:
Your AntiVirus Software:
If the first thing you think is “What’s that?”, then you need to be nervous. Not only should EVERY computer have AntiVirus software installed, but it needs to be updated regularly. Most new computers come with with a 90-day or 6-month trial of some kind of AntiVirus software. What most people don’t know is that this software “expires” unless they pay a subscription or maintenance fee after the trial period ends. If your AntiVirus software is out of date and you don’t want to spend a lot of money on a subscription service, there are free AntiVirus solutions that do a good job (sometimes better then the “pay” software) of keeping your system safe. You do need to make sure that the “scheduled updates” feature is turned on and set to check at least once a day for updates.
Your Personal Firewall:
This barely scratches the surface of how to keep you computer(s) that are on a broadband connection safe. Some of these things you may be able to implement on your own, while others may need help with their security.
Let’s start with the router. There are many brands of router and each has a slightly different way to log into them. This they cover in the manual that came with the router. If you have misplaced the manual, then you can find a new copy on your manufacturers web site. Click any of the images in this post for a larger image.
The first thing you need to do is log into your router. For my examples, I will be using a LINKSYS router, which is one of the most popular brands today. LINKSYS routers come with a software package to help you get them setup. Because of this, often people do not know what IP address their IP address is or, more importantly, the IP address of their router. There is a simple way to get his information. I most windows operating systems, you can open a command prompt window and type the command “ipconfig” to get the information you need. What you are looking for is the “Default Gateway”. In the case of my example it is “192.168.8.1”. The default gateway is the path that all information bound for the internet will take to get there.
After you find you “Default Gateway”, open a web browser (most of these routers work best with Internet Explorer as some of the content can be active) and, in the address bar, type in the IP address. The LINKSYS routers will prompt you for a username and password. Other routers will take you to a page with blanks to enter the username/password.
(SECURITY RULE NUMBER ONE: Make sure you change the default password of the router, which is often “admin” or blank. If you do not, all if these steps to secure your router are for not)
If this is a new router that you just took out of the box, it may walk you through a wizard to set it up. For purposes of this example, I am assuming that this is a router that has already been setup and is being used. Since we are focusing on wireless security, I am going to move right to the “Wireless” tab in the router, where I can go to “Wireless Security”. By default, “Security Mode” is set to disabled. If you click on the drop down, you will see multiple options. Not all routers have all of the options seen in the example. Some may have more, some may have less. I am going to walk through each of the four options shown in the screen shot.
WPA-Preshared Key (WPS-PSK) – WiFi Protected Access is a very secure method of protecting your data. Each packet of data that is send between your wireless router and your wireless device is encrypted with a different encryption key. What this means is that if someone were to “capture” a packet of data, crack the encryption string and then try to read the rest of your data, they would fail. The chances of the same encryption string being used a second time are very small. Some of the newest routers are now using WPA2, which migrated the key generation from 24-bit to 48-bit, virtually elimination the thought of duplicating a key. The Preshared Key portion of this security mode means that you assign “password” that you share with each authorized user. They enter the “password” once and their device takes care of the rest of the security from there. Personally, I recommend a “passphrase”. This can be anything you want it to be, and I always recommend leaving the spaces and punctuation in the phrase. The longer the phrase, the less likely someone is to guess it. The AES encryption algorithm is my personal recommendation, because AES uses a 128-bit, 192-bit or 256-bit key, making this option the most secure. Some routers let you choose the bit strength. This LINKSYS does not, but I believe defaults to the 256-bit standard. TKIP is not an encryption algorithm, but a “key exchange” protocol. While still secure, it is not as strong as AES and also makes for a slower connection as there is more overhead for your routers processor. TKIP is a software base protocol, where AES is hardware.
WPA-RADIUS – This is similar to WPA-PSK in that the encryption key changes with each packer. The difference is that you now need a Radius server. This allows you to “authorize” specific devices to access your network. When a device tries to connect, the access point looks at the “authorized” list on the Radius server, and if it finds the device listed (usually by MAC address(more on this later) ) then the device is allowed to access the network and the WPA encryption process takes over from there. This is by far the most secure method of making your data and network private. The catch…you need a Radius server and you need to know how to set it up properly. This is usually something that only large businesses do because of the high overhead of this operation.
RADIUS – RADIUS is an Authentication, Authorization and Accounting protocol. It is what most ISP use to authenticate users who connect. In the case of WiFi security, RADIUS typically uses the devices MAC address, and sometimes a username/password combination to authenticate the user, authorize the device and account for the connection the the network. Again, the catch is that you need a RADIUS server, so this is yet again a tool the large organizations usually implement. In the case of this particular LINKSYS Router, the RADIUS option also makes use of WEP (see below) to provide the encryption method, and you can enter a “passphrase” and have the WEP keys automatically generated for you. Not all routers have this option, meaning the keys have to be generated manually.
WEP – Wired Equivalent Privacy uses an encryption key that is entered by the user of the wireless router. In the case of this LINKSYS Router, you can also enter a “passphrase” and have the keys generated automatically. You typically have the option of 64-bit or 128-bit encryption (some routers offer higher bit counts, but not many devices support this), which sounds pretty good, and for many people is adequate protection. The drawback to this is that the encryption key never changes, so if the key becomes compromised, then your security of gone. You also have to manually enter a complex encryption key on each device that is going to use access your network, and you have to do it accurately…twice. WEP usually lets you create four keys as well as setting a default key. WEP is the original, and least secure, option for wireless security, but any security is better then “wide open”, or no security.
One more option for even greater security is Wireless MAC Filtering. At this point, most all routers support this feature. Every network access device, wired or wireless, has a unique identifier called a MAC Address (Media Access Control address). These address can be found on a sticker on the device, or by opening a command window on your Windows system and typing “ipconfig /all”. The “Physical Address” is the MAC Address.
Enabling the Wireless MAC Filter and setting the “Permit only…” option is the first step. You then need to edit the MAC Filter List to add the MAC address of the devices that are going to be allowed to access the router. Even if this is that only thing you do, and you never setup WPA or WEP, your security will be increased.
Limiting the devices that attach to your router as well as implementing one of the encryption options is going to save you a lot of potential headaches, as well as keeping your neighbors off the broadband connection that you are paying for.
Wardriving – What is it, and why does it affect me?
Back in the days when the only cost effective way to get on the Internet was with a modem, people used to use their computers to dial random phone numbers, hoping to connect to another computer that they could then pillage for data. This was called “War Dialing”. I actually knew a guy who took this a step farther and wrote a program on his Commodore 64 that could spoof the phone company computers and let him make “free” long distance phone calls…well, at least free to him…but I digress. In the modern day of broadband and high-speed internet, people have migrated from modems to routers, many of which have wireless capability. “War Driving” is the act of driving around in a car looking for “open” wireless access points, usually with a booster antenna on the roof that is attached to a wireless LAN card in a laptop. But these days, this can also be done with a PDA, like an iPAQ.
“So how does this affect me” you ask? Well, if you like giving all of your neighbors free access to the broadband you are paying for, it doesn’t affect you and you can stop reading here. But it’s not just your neighbors that may be “borrowing” your broadband. There are web sites dedicated to showing where “open” wireless access points are all over the country. Just search Google or your favorite search engine and you will find various “projects” that have taken place across the country that show both secure and unsecured wireless access points. These include businesses as well as residential access points. The maps of Manhattan are especially eye opening. So, what does this all mean? It means that anyone with a tool like NetStumbler (which is free) can find your wireless access point and then make use of it, completely anonymously. This is one of the scariest things. All these unsecured access points have given any potential terrorists a completely secure and anonymous tool to get online. Any suspicious activity would be traced back to you. Do you really want the potential of having the FBI or other law enforcement agency knocking on your door, or worse yet knocking our door down? Maybe even taking all of your computer equipment? I know I don’t, and I don’t believe anyone else does either. This is one of the reasons I have dedicated my business to security and trying to educate the public and business world about the dangers of having their wireless networks unsecured.
And all this can be done just by driving down your street. Want to know how to secure your wireless router? Read my article on securing your router, or if you are not comfortable making the changes yourself or have trouble, contact a support person in your area. They can help you make sure your wireless is secure. You can even give then a copy of my article and have them check off each of the steps as they are completed.