Identifying threats in a wireless environment
Chris Viklund · KTH Publication Database DiVA (KTH Royal Institute of Technology) · 2005
Threats towards networks are a constant problem, given the rise and rapid growth of the Internet these have increased by magnitudes. In order to secure networks, patch management is a necessity as well as using firewalls and access control mechanisms. If a network-connected host is fully patched, could it still be subject to various break-in attempts, and if so, could they be detected? Having a complete view of the threats directed towards a network became realized in the birth of intrusion detection systems. By utilizing intrusion detection systems for monitoring network flows for malicious activity, system administrators can learn which attacks are destined towards their networks and thereby obtain a better view of the threat level directed towards them. The main goal of intrusion detection systems is to capture and log threats towards the networks, not necessarily prevent them from happening. This thesis has explored how an intrusion detection system can aid in detecting threats towards a wireless communication. Given the inherent problems that exist in wireless conversations regarding eavesdropping and badly implemented security (WEP): could any of the threats be identified by an intrusion detecting system? The answer is yes and no. It is impossible to detect eavesdropping of the wireless medium, but other attacks directed towards wireless products can be detected in most cases. Furthermore, the thesis setup a secure wireless communication utilizing a RADIUS server for authenticating clients and the TKIP encryption scheme for ensuring a stronger encryption than WEP. When monitoring a wireless communication with such characteristics, not much could be deducted given the security scheme, and most of the threats directed towards the test bed could be detected by the intrusion detection systems used.