1

Background:

  • Fabrication of data is a high security concern
  • Interception of (most) data is a low security concern
  • Destruction of data is a medium security concern (everything is backed up, but production would be crippled for hours)

Question:

I just came into a new IT position. Currently our WAP is setup with the WPA protocol and a MAC access list.

Personally I think with 60 end users and over 100 wireless devices that constantly grows and changes, managing the mac address list is ridiculous, especially since it is being duplicated over 3 WAPs manually.

Even if a malicious user got on our network, the damage they could do is somewhat controlled through group policy. The building is so big, it's just as likely someone unauthorized will just sit at a terminal and try to break stuff, I've made most users have very limited access to company data so that should be minimized.

I would like to take the approach of just not giving anyone the key since WPA encrypts the key on the users system anyway. It seems like the WPA key being secret is secure enough for wifi, am I just misinformed and is my way acceptable for my security conditions? It seems like having physically unsecured computers is just as dangerous. I'de rather not worry about wifi when it has a key on it whereas my 100s of ethernet outlets do not.

Improve this question

2 Answers 2

Reset to default
4

As MAC addresses can be spoofed (and are sent unencrypted), access lists based on them are ineffective. I agree that your time is better spent elsewhere. Also, WPA-PSK (aka WPA Personal, which is what I am assuming you are set up with) is in my opinion insufficient for businesses of your size. A single shared secret does not keep secret, especially when it can be brute-forced offline. You therefor may wish to invest the time you would have used maintaining your access list into setting up IEEE WPA-802.1X (aka WPA Enterprise)

Improve this answer
1
  • 1
    +1 for WPA-Enterprise / 802.1X. But while you're at it, you really should be using WPA2, not just WPA.
    – user12272
    Commented Aug 16, 2012 at 19:56
1

Windows stores all keys as plain-text (click on connection->view password). For a company your size you need something like a radius server, and using certificates to authenticate users.

Improve this answer
1
  • Even Windows 7 and 8 store in plain-text? I thought Microsoft had come up with some kind of king ring by now. Also, good advice.
    – chao-mu
    Commented Jul 12, 2012 at 20:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .