36

From a security perspective, is it considered bad practice to use the company name as a part of an SSID?

Assuming that the company is located in a densely populated area with a lot of "competing" wireless networks, having an easily identifiable SSID would make it easy to find the network for those who work at that office. However, it would be equally easy for others outside the office to find the network.

Would I be overthinking this if I required wireless network SSID's to be random strings?

81

"Hiding" your SSID is just "security by obscurity" - like hiding the front door key under the mat. It works only as long as no one figures it out. Once it is figured out, it provides zero security.

In general, you want security measures that will work even if everyone knows what measure you've used.

Yes, by providing your name, any opportunist can focus on your network if they have that desire, but just having a WiFi network broadcasts that a network is there, anyway. If someone is targeting you specifically, they will find your SSID, even if you obscure or hide it.

So, hiding or obscuring the SSID provides very, very low protection. Unless you have a specific reason to need such specific, low, and opportunistic protection (and there are possible reasons), I'd focus on securing the network instead.

As JPhi1618 and emory point out in the comments, you could even create a security issue by using a nondescript SSID: If you set it to df42Sdd235f2, for example, then someone could set up a WiFi network with your company name or even df42Sdd235f3 in order to attract people to connect to it instead of your corporate network and the victims would not have any clues that the network was not the official network.

| improve this answer | |
20

It doesn't help for reasons described in other answers. And there is actually a way for an attacker to use strange SSIDs against you. If your access point authenticates itself with a certificate and its SSID is "Company", then no attacker can claim to be "Company". They would need to choose another SSID, so there would obviously be two networks and this would hopefully make employees think about which one is right (and notify/ask someone who would be able to tell that this is an attack).

If the official network is "iewrbfpwh" and an attacker creates a network "Company" you can be sure some people would connect to it by mistake.

| improve this answer | |
10

From a security perspective, is it considered bad practice to use the company name as a part of an SSID?

No.

Would I be overthinking this if I required wireless network SSID's to be random strings?

Yes.


While doing this may prevent the simply curious, this will in no means deter an interested or determined attacker. Effective security should always put more burden on the attacker than the resource being protected. So let's examine this a bit.

Even if you are in a large multiple story building in the center of a large metropolitan business district (probably the extreme example of "located in a densely populated area with a lot of 'competing' wireless networks"), it would take no more than knowing you were there, a moderate amount of access (for example stairwells typically are easy to access for escape purpose and will suffice for the purpose), a laptop running Linux (or other OS with specific tools available), and 10-20 minutes to figure out which wireless network(s) were yours. Having some other 802.11 tools available and/or more access, it could be done easily in less than 10 minutes.

If you have a guest network that is easily recognizable by visitors, it's possible to determine your networks in less than a minute.

Now, compare that to the burden put on your users and IT staff. How confusing this would be to them, how many mistakes were made, how many times the questions are asked, etc. Depending on the size of your organization, this would be well over 10-20 minutes per day and would certainly be much more when you first establish this policy (each device would have to be "touched" in some fashion, etc).

This fails the test of effective security and enters the realm of security theater. There is really no security benefit to this type of action.

| improve this answer | |
  • 3
    You drastically underestimate how easy it is to figure out which SSID is from the target company. Even I, firmly in script-kiddy territory as far as skill level, if I have access to any staircase or hallway on your floor, or the floor above or below, and know roughly what part of what floor you're on (usually shown on a sign in the lobby), can trivially find your obfuscated SSID in way less than 10 minutes (excluding travel time to your floor from the ground) with a smartphone app, and staring at a phone while pacing the hall is way less suspicious-looking than having a laptop open. – Matthew Najmon Jan 31 at 19:08
  • @MatthewNajmon, this may be more difficult than you think depending on how big the organization is, how many tenants per floor, the floor layout and the location of the stairwells. Finding the SSIDs is no problem, positively identifying which SSIDs are with which company can take a bit more time. And as a network engineer with 20+ years of experience, a great deal of experience with wireless tracking and wireless in general who has done this multiple times before, I gave a very solid conservative estimate. Can it be done faster, certainly, but I can do it in 10-20 minutes in the worst case. – YLearn Jan 31 at 20:12
  • No, I know quite well how difficult it is, as I've actually done it (as an educational exercise; went on a kick a few years back learning all about how wifi signals propagate, why the shadows are where they are, etc). I will acknowledge that there may be a worst-case that would take me longer, that I just didn't encounter in my tests, but then, you should probably make it a bit clearer in your answer that "10-20 minutes" is worst-case, and that typical is much faster. – Matthew Najmon Jan 31 at 20:32
  • @MatthewNajmon, I have done this fairly often and 10-20 minutes is the time frame I would estimate to any customer asking me for this, as I know I can do it in that time frame. I already say in my answer that it can take far less. I ran out of space in that comment, but I could go on with the challenges if you like. Most enterprise wireless systems will use some sort of RRM process that will run APs at lower than maximum power. Omnidirectional antennas found in laptops and the use of multipath since 802.11n make triangulation difficult and more time consuming for accurate results. And so on. – YLearn Jan 31 at 20:39
  • 1
    Earlier to 802.11n, multipath was considered bad for wireless design. While APs had multiple antennas for diversity, it would switch between them for transmitting and receiving from clients. With 802.11n and multiple spatial streams, multipath is generally considered an advantage. – YLearn Jan 31 at 23:17
6

I would not broadcast an obvious SSID name. While I do not believe in security by obscurity, I don't see a strong incentive in advertising your identity over the airwaves. And the SSID doesn't have to be random characters, it can be somewhat memorable but unrelated to the actual company name.

I'd rather brief the people who work in your office and grant them access on a need to know basis, because you'll have to provide them with the password anyway, right ? And it's usually configured once on their device, unless you have some additional setup we don't know of. So I don't see much of an inconvenience here.

That being said, I think it depends on the purpose. I might broadcast the company name on a guest network for visitors, that grants access to the Internet and nothing else. In this case, you want to make it easy for outsiders to find the wifi network.

If the wifi hotspot is connected straight to your LAN then I would rather keep a lower profile. I might even hide the SSID if it is practical to do so. Although we all agree that does not provide protection but frustrates reconnaissance efforts.

| improve this answer | |
6

One thing to bear in mind is that some devices broadcast which SSIDs they have previously connected to when they're out and about. This may make it trivial to identify employees/visitors to your company away from the site itself.

It will depend on your threat model as to whether this is a concern, though.

| improve this answer | |
  • 1
    I love this angle in that it focuses on the employees when not protected by the network controls. – schroeder Jan 31 at 12:00
2

... is it [a] bad practice to use the company name as a part of an SSID?

As schroeder mentions above, probably not.

However, it feels like you are setting a bad example, right?

Just pick something and consistently use that - everyone will still know what to pick off the list, and you don't look "unsecure" to people who aren't informed.


Anecdote:

A friend who works for X (a fortune 200 networking company) was at my house a couple years ago with his work laptop. "Oh! Blizzard."

Me: "Huh?"

"I just got into my company's internal network. Blizzard is the network id my company uses, but I didn't realize they used it everywhere."

Me: "Ah, that SSID. Neighbor works for X."

| improve this answer | |
  • 1
    The problem with that, as many have pointed out in great detail on this page, is that it's not just that it's not bad practice to leave it obvious, but that it IS bad practice to obfuscate it. Not only are you causing more trouble than you're saving, but you're also perpetuating a bad practice in the name of looking good to the idiots. – Matthew Najmon Jan 31 at 19:12
  • @MatthewNajmon "looking good to the idiots" seems pejorative. The question here deals with the impression you are making with people who are ignorant of security concerns - not idiots. While is it true that security by obfuscation is theoretically a bad idea, I would still advise you to put your laptop in the trunk of your car rather than leaving it out on the passenger seat. Yes, it is better to not leave the laptop in the car - but if that isn't an option, you should put it in the trunk instead of leaving it visible. – J. Chris Compton Jan 31 at 20:25
  • You prefer "looking good to the ignorant", then? Fine, it's too late to edit my comment, but I freely acknowledge that I'm quite as happy with that phrasing as with the one I originally used. Also, the trunk thing is another example of you perpetuating bad advice, since depending on the car, the trunk might get hotter in the summer, and is quite likely to get colder in the winter, and in most parking locations, battery damage should be a higher-order concern for someone leaving a laptop in a car than someone smashing the window to grab the laptop. – Matthew Najmon Jan 31 at 20:37
  • I should add, in most parking locations, and for most laptops, though any laptop that's sufficiently security-sensitive to swing this, should never be left completely unattended anywhere short of a properly-installed safe. – Matthew Najmon Jan 31 at 20:44
  • @MatthewNajmon You should reread my comment. Specifically the last sentence "Yes, it is better to not leave the laptop in the car." Because sometimes people have to leave a laptop in a car... and when they do, it is generally better to not leave it visible. – J. Chris Compton Jan 31 at 20:46
1

Not broadcasting any SSID, combined with MAC filtering, might be the only approach which adds to security - because this requires an additional factor for the authentication and it would only permit known devices. The down-side is, that it also adds administrative effort for adding/removing MAC addresses and supporting users with setting up eventual BYOD.

| improve this answer | |
  • 1
    If only devices managed by the company connect to it, not broadcasting can indeed be a good idea. However MAC filtering? Come on... Proper authentication using individual logins or certificates is a much better option. – jcaron Jan 31 at 16:49
  • 1
    The same processes that find the hidden SSID will also capture client MACs that can be spoofed to get access. Since this is so trivial to bypass and the overhead to maintain is so high, this is highly inefficient security. It really adds nothing and detracts from time/effort that could be used to deploy/maintain an alternative that provides more efficient security. – YLearn Jan 31 at 17:00
  • 1
    This still raises the effort required to attempt authentication - at the cost of some effort. People trying to war-drive (with a notebook in a car) might rather attempt seemingly easy targets, than targets which seem to be better maintained - based on the estimated amount of time to be spent for results. – Martin Zeitler Feb 1 at 1:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.