Secure Wireless Implementations

Question

For quite a while now, I have grown to treat wireless networks as inherently insecure. As part of this, I put them on the public Internet and require VPN connections to access company resources.

My wireless vendor is claiming that this is no longer necessary. They recommend a WPA2 Enterprise implementation using NPS and 802.1x, which would be connected directly to the corporate network. This network will not have production data or any data that would have any regulations associated with its handling.

My initial research seems to indicate that this implementation is considered reasonably secure. Would I be exposing my corporate network to additional risk by using this implementation?

Answer 1

Architecturally this is likely to be reasonably secure, however there are still some things to consider.

1. Do you have Full-Disk Encryption on any laptops which will be accessing the service? If not there are some risks if a device is lost, as the credentials for accessing the network will be stored on the laptop (cached windows creds and the machine certificate if used)
2. How will the guest network be configured exactly? I've seen some implementations where there's some information leaks where the guest uses the internal DNS servers, so they can query internal server names. A minor point on it's own but worth thinking about.
3. Be careful to check that the APs are correctly configured. Most implementations have both networks on single APs so if there's a configuration issue it can lead to unauthorised access to the Internal network. If you think of your access points like firewalls in terms of change control (as they effectively segregate an untrusted network from a trusted one) that's a decent way to go.
4. It's worth making sure to use something like WPA2-PSK on the guest network, I've seen quite a few implementations where it's unencrypted and it just leaves guests at risk for no major benefit (assuming that they'll need to authenticate anyway via a captive portal or something similar)

Answer 2

Given the assumption that the wireless network is for internal use only, yes it will be reasonably secure.

You should of course have the usual network security measures in place like firewalls to allow only whitelisted traffic.