At an organisation if their Wifi is secured with WEP? why is this particularly bad for the organisation/business itself, I know WEP is a weak security algorithm which easily cracked but why is this specifically bad for the organisation? In other words how does this impact a business?
Why is there a WiFi at all ? That is the question.
When a WiFi access point uses WEP, it can be broken into, meaning that outsiders can also connect to the access point, and use it, and spy on the communications of other people using the same access point, and remotely disrupt it at will. Any business which is conducted over that access point can thus be impacted, if only for the availability.
Even if the said WiFi is there only as a convenience for visitors (as if it was, say, an "open WiFi" in some fast food restaurant), this can still be damaging to the public image of the organization. If the WiFi access point is merely used as free Internet access by the neighbourhood, then that's not a big worry -- unless one of the freeloaders uses it as starting point for an attack elsewhere.
Fast food restaurants and other open WiFi access points can get away with it because everybody understands that an "open WiFi" is really open and the provider cannot be held responsible for who connects to it. So what this means is that your organization, instead of using WEP, should make the access point simply completely open, so as to dispel all doubts on the total absence of security and responsibility for that access points.
Or, said otherwise: if you suggest switching from WEP protection to an open access points and some people scream and whine and oppose to it, then you will have identified who is using the WiFi for sensitive data -- and WEP is too pathetically weak to be entrusted with sensitive data.
I can give you two personally witnessed anecdotes:
- As part of PCI compliance we had a company come in and attempt to breach our web servers. The first thing they did (since they were in our office) was guess the Wifi password, guess the dev server root password and pull database passwords from the source code of our website. They also analysed the source code for vulnerabilities which is much easier and less noisy than attacking the web servers directly. The dev server root password was weak on the assumption that it was on a private network and wasn't protecting production data.
- At a different company later on, I discovered the primary SSL private key in a directory on an internal webserver in the office. The only protection this private key had was the WEP-based wifi. Again, the same assumption was made that internal office networks were safe from attackers.
Had an attacker discovered either of these before we had (and we don't have any way of knowing that they didn't other than we haven't discovered a credit card breach yet), the business impacts could have been disclosure of credit card information. In the second case the wifi actually was using WEP and in the first the attacker would have had the same access whether by guessing the weak password or cracking the WEP.
It is a common assumption that internal networks are secure from attackers and this leads many people to expose information that should not be exposed.