CSG 5308 Wireless Security: Analyzing Rare Vintage Auto Parts Ltd

This case study analyzes the wireless security vulnerabilities of Rare Vintage Auto Parts Ltd, a company experiencing network issues across its multiple offices and warehouse. The analysis identifies several key risks, including broadcasting the company's SSID, weak wireless encryption, mismatched antennas, high power gain access points, lack of a firewall and VPN, absence of network sub-setting, missing designated and backup routers, mixed network card standards, no data backup mechanism, and the absence of a network security policy. The report proposes solutions such as hiding the SSID, implementing enterprise-mode Wi-Fi, using stronger encryption protocols like WPA2, deploying matching antennas, adjusting access point power gains, implementing a firewall and VPN, configuring network sub-setting, establishing data backup and recovery systems, and creating a comprehensive network security policy. It also suggests deploying Cisco Unified Threat Management Systems and Microsoft Azure cloud computing services for enhanced security and proposes a Bring Your Own Device (BYOD) policy to manage employee-owned devices on the network, covering aspects like privacy expectations, acceptable use, and user agreements.

WIRELESS SECURITY
NAME
COURSE
AFFILIATION

Abstract.
Rare vintage auto parts limited supplies spare parts to the automotive industry. This
systematic review paper addresses the network security concerns of the firm. The paper seeks
to address the issues in the network’s wireless system, network links, till system and the
hardware or software that enables deployment and communication of data transfer
mechanisms in the different cities located in different areas of the city. The report addresses
the issues responsible for the disabled communication within the company’s infrastructure in
the following categories; poor encryption system, broadcasting the company’s SSID,
unprotected network without a firewall and Virtual Private Network, mixed data cards and
operations without policies, principles and guidelines to the employees regarding the
network. Additionally, this article discusses the ways and mechanisms in which the network
security and communication system will be made efficient using a software and hardware
infrastructural design complimented by a Bring Your Own Device Policy.

Table of Contents
Abstract................................................................................................................................................2
Introduction.........................................................................................................................................3
Methodology........................................................................................................................................3
Findings................................................................................................................................................4
1. Broadcasting the company network SSID..................................................................................4
2. Wireless network is configured to personal mode:....................................................................5
3. Weak wireless network encryption.............................................................................................5
4. Antennas used to not match.......................................................................................................5
5. High power gain access points..................................................................................................6
6. The network is not protected by a firewall or Virtual Private Network(VPN)...........................7
7. The broadcast domain is not configured to enable network sub-setting....................................8
8. Network lacks a designated router and back up router..............................................................9
9. The network was deployed using mixed network cards with different standards.......................9
10. The company has no data backup mechanism and recovery system....................................10
11. Rare Vintage Auto Parts Ltd has not provided its management and employees a network
security policy and guidelines..........................................................................................................10
Deployment Of Appropriate Software And Hardware...................................................................11
1. Rare Vintage Auto Parts Ltd should purchase and deploy Cisco Unified Threat Management
Systems............................................................................................................................................11
2. Microsoft azure cloud computing services...............................................................................11
Bring Your Own Device Policy.........................................................................................................12
Privacy expectation...........................................................................................................................12
Acceptable use....................................................................................................................................12
User acknowledgement and agreement............................................................................................15

Introduction.
Rare vintage auto spares limited company raised concerns by the management and
owner to address network related limitations to full functioning capabilities of the company.
The network issues raised included failure to provide a smooth communication between the
company offices situated at different locations in the city leading to numerous data losses,
failed purchases and deliveries and reduced revenues due to a drop in normal business
activities. The issues peaked with the dismissal of the network’s IT administrator who was
described as rude and would access illicit content via the network system. The network failed
and was not serviceable after the dismissal with replacement of a non-expert in the IT
administrator docket, Miller et al (2012).
This report addresses therefore, the identified and analysed risks generated from the
network vulnerability to external malicious individuals. The network threats and
vulnerabilities derived from the poor networking security practices in the company have been
assessed using the risk matrix and mitigations documented. In this report, the following will
therefore be addressed circumstantially using the risk assessment matrix: poor data
encryption mechanism, antenna types with a very high power gains and mixed network data
cards, Thomson, G. (2012).
Methodology.
Data collection was conducted to collect data and analyse the network security system
and provide solutions to the identified risks. The following methods were applied:
In-depth interviews: 27 employees participated in the data collection process. From a
random sample, the participants were asked to provide their feelings, opinions and knowledge
about the company’s network system in terms of access, usage, coverage, strength, speed and
security, Song, Y. (2014).
Network security testing: a thorough static, dynamic and live testing procedures were
conducted on the network to determine the vulnerabilities in the code and running mode and
a vulnerability report was generated, Gollakota, S., & Katabi, D. (2011, April).
Secondary sources of data: the files in the storage facility of the company including
deployment files, tender files and employee files were analysed for data the network system,
usage, privileges and authenticity, Zou et al (2016).

Participatory observation: directly involved in the activities of the selected employees
observing, taking notes, asking questions and attempting network procedures during the
operations of the company daily activities.
Findings.
O
C
C
U
R
R
E
N
C
E
SEVERITY.
INTOLERABLE UNDESIRABLE TOLERABLE
VERY LIKELY Network and
system failure.
Poor network
performance.
Man-in-the-
middle
eavesdropping.
LIKELY. External attacks. Network misuse
by the
employees.
High cost in
running and
maintain
network.
NOT LIKELY. Data losses. Theft,
destruction of
network
components.
More power
consumption
in network
operations.
1. Broadcasting the company network SSID.
The wireless network of the company broadcasts its service set identifier allowing
external users in the public to be able to detect the network and connect to it. The routers
send the connection capability of the network through the network beacon frames, Thomson,
G. (2012). Compounded by the poor encryption used to secure the wireless network, third
party individuals with malicious intentions are able to connect to the network and interfere
with the normal functioning of the network through activities such as networking
communication breakdown through tampering with the network’s SDN. Mesh topology is
employed here as below.

Solutions.
The network’s service set identifier should be set to hidden in the network set up and
configuration. In the process, to enable the employees connect to the network, the company
devices such as computers and billing machines or the employees’ personal devices to be
configured with the network prior to connection and access. This will minimize the
unauthorized access from third party hackers, Song, Y. (2014).
2. Wireless network is configured to personal mode:
The company’s wireless network apart from broadcasting the SSID, is configured to
personal mode with a dynamic host configuration protocol that allows the employees and
other users connect to the network by using a paraphrase and the network settings are stored
on their devices, López, J., & Zhou, J. (2008). This exposes the wireless network to
unauthorized access by malicious third party persons when they can use the employee
devices when the devices are stolen or lost.
Solutions.
The network configuration protocol should not be set to dynamic to disable the access
by third party individuals or attackers, Song, Y. (2014).
The wireless Wi-Fi network should be set to enterprise mode to allow the employees seek
configuration from the network administrators to be able to access the network to prevent
attackers and also monitor network activity while enforcing privileges.

3. Weak wireless network encryption.
The company uses the Wired Equivalent Privacy to encrypt the wireless network that
provides a very basic security level that can be found in the wired networks. This type of
encryption is very weak in terms of the keys generated to provide for authentication and
therefore allows for man-in-the-middle to eavesdrop on the data being transmitted through a
packet sniffing vulnerability. In the WEP encryption used by the company to secure the
network, the resulting WI-FI is vulnerable in that it uses the RC4 cypher engine that uses a
repetitive mechanism to generate encryption keys in 40 bits that can be easily hacked.
Additionally, through network exploitation tools freely found in the dark web, the data traffic
transmitted within the network can be analysed using the data generated passively from the
network that can be analysed to determine the encryption keys used in the network.
Solutions.
The company should configure the network routers after purchase with the latest
network security features out of the box.
The latest data and network cypher protocols should be implemented such as use of WPA
and WPA2 to enable stronger encryption and authentication during data transmission or
network log in.
4. Antennas used to not match.
The company deployed the network system with a different set of antennas to generate,
transmit or receive the signals. The antennas are a 16dBi Omni-directional antenna and 6dBi.

These are two antennas. The transmitter, generates and transmits signals at 16dBi in the 360
degrees’ plane in all directions for the receivers to pick the signals. However, the receivers
with a 6dBi signal capability, receives very poor signals from the transmitter and thus the
communication breakdown experienced in the company, Scarfo, A. (2012, November).
Additionally, the antennas are widely spaced from each other with the average distance
between the transmitter and the receiver large enough to allow signal distortion, interference
and blockage along the way.
Solutions.
The company should budget for and purchase new hardware of antennas that have a
similarity in the power gains, transmission frequencies and wavelength and with effective
signal strengths in terms of transmission and receiving to enable proper communication.
The transmitters installed should be uni-directional, sending the signals in a single
direction towards the receiver to enable signal concentration and efficient communication,
Scarfo, A. (2012, November).
A direct access line between the transmitters and receivers should be established to
reduce interference of the wireless signals by buildings, structures and tress.
5. High power gain access points.
Wi-Fi systems are designed to increase their signal strengths by consuming more power,
this phenomenon is called power gains to reduce the interference or coverage. In the office
layout of the Rare Vintage Auto Spare limited, there is very high interference and therefore
the administrator deployed a system with a very high gain to increase the signal strength
transmitted to the receivers. However, despite the increase in power consumption to increase
the signal strengths, the Wi-Fi coverage reduces, Scarfo, A. (2012, November). Additionally,
since the transmitter and access points are running on high power gains, the receivers are
maintained at low power gains. This results in a stronger signals enabling all the peripheral
devices acting as receivers get connected to the access point. However, the devices acing as
receivers are able to push data through the network back to the access point to be directed to
other components of the network such as the servers or other peer devices. In such
circumstances, the network signal is recorded as excellent while there is no communication
between the connected devices because of the high power gains of the transmitter as
compared to the low power gains in the receivers.

Solutions.
The company, Rare Vintage Auto Spares limited should deploy access with suitable
power gains that is equal to the receiver’s power gains in the ranges of approximately 25-
50Mw, Lashkari et al (2008).
To reduce the number of access points in the geographical area within which the Rare
Vintage Auto Spares limited offices are located, low power gain access points should be used
to increase coverage while maintaining an effective wireless network strength that enables
communication and data transfer.
6. The network is not protected by a firewall or Virtual Private Network(VPN).
The company (Rare Vintage Auto Parts Ltd) is founded on the infrastructure of using the
internet to provide for communication and enable smooth flow of business, increasing
employee throughput and productivity. The internet is the primary pillar linking the company
offices, billing machines and employee devices to the management and main server. The
application of the internet is advantageous, however, exposes the company to the public and
other internet users including individuals with malicious intentions such as hackers and
attackers.
The company uses only an antivirus to protect the network system and therefore the
system is exposed to multiple vulnerabilities and threats such as spyware and ransomware
due to lack of a firewall and VPN. Due to the lack of a firewall mechanism and VPN to
protect the network against unauthorized access, the network, with its broadcasted SSID is
very vulnerable from remote attacks. As a company network, using the wireless network as a
public internet access medium exposes the company’s system to attackers and hackers. The
lack of a virtual private network does not provide the company’s network system with the
additional advantages of data encryption in secure tunnel of communication thus protecting
the data from spoofing and eavesdropping.

Solutions.
A network firewall should be established to protect the network from unauthorized
access by online users from within the company or the remote users by controlling the
authentication and permissions granted to the users of the network.
A virtual private network should be configured with the tunnelling security protocol
and layer forwarding in the network to enable secure authenticated communications and data
transfers between any connected devices on the network.
In order to provide additional security to the network, third party subscription services
with intrusion detection should be installed, configured and deployed to monitor and alert the
administrators for any suspicious activities or traffic. The detection system can be advanced
to provide additional security through blocking suspicions and malicious IP addresses.
Intrusion prevention systems should be sourced for to compliment installed and
implemented security protocols to offer outright security in case of malicious intrusion by
monitoring traffic and IP addresses, blocking the identified threats and generating the logs
and attack reports for future security additions.
7. The broadcast domain is not configured to enable network sub-setting.
In the Rare Vintage Auto Parts Ltd company, all the connected devices use a similar
infrastructure subnet to connect to the network and transfer data. In such a configuration, the
network traffic becomes too slow and performance reduces. In this deployed network design
and system, the same data packet is shared to all the connected devices on the subnet with an
entry point on the network regardless of whether the device needs or does not need the data
packet. The device spamming of the network subnet reduces the performance of the network
and the connected devices. Due to the network operating on the same subnet, the devices
connected congest the network with data packets and different identification addresses
reducing the efficiency of the network with regards to speed, traffic monitoring and security.
Solutions.
Unique IP addresses specific to the company should be assigned to the connected
devices to identify the devices and therefore provide an easier mechanism for data routing,
monitoring of traffic and security.

The network addresses and domain should be divided into subnets in terms of address
and masks using a 32-bit key system to identify the host and other network parts for effective
data routing to only the network component that requested for a particular set of data.
The connected devices on the network with entry points should each be configured and
assigned to different subnets of the network to reduce congestion, network lagging and
increase the performance in terms of speed.
8. Network lacks a designated router and back up router.
The function of a designated router is to form a channel source for all the network traffic
and system updates. The designated router defines the network topology and establishes a
slave-master relationship with all the other routers to control the direction of the data being
transmitted within the network and reduce network “confusion”. In the case that the
designated router breaks down, the backup router performs the functions of the designated
router and ensure continuous network performance before repairs. In the network system
deployed by the Rare Vintage Auto Parts Ltd IT stuff, the network has no described
designated router nor backup router and therefore the data traffic is not controlled leading to
communication failure. Additionally, the network is not serviceable because the network
update could not be send without a designated router.
Solutions.
A multi-access network links should be deployed with an advertisement functionality
for network control in order to reduce the data traffic generated.
As an OSPF multi-access wireless network, two routers should be identified as designated
and backup routers using the IP addresses with the designated router having the highest IP
number on the network configuration. With this network design and topology, the designated
router generates link data packets transmitted within the network in a slave-master connection
protocol to utilize the sync link-state databases and ensure efficient performance.
9. The network was deployed using mixed network cards with different standards.
Although the different network card standards of 802.11b and 802.11g can be easily
applied and deployed on the same network, the slower performance and outdated encryption
of the 802.11b standard will reduce the efficiency of the latest standard 802.11g to allow
connection. In the deployed wireless system of Rare Vintage Auto Parts Ltd the performance

and encryption of the 802.11b standards are used and hence the slow data transfer rates with
poor security of the system. For a short-term goal to save the budget, the mixing of card
standards works fine but the long-term benefits are extremely diminished.
Solutions.
For the long-term benefits of efficient data transfer, a more secure system and increased
speed of the network, all the data card standards should be upgraded to 802.11g. Despite the
802.11b network standard being cheaper, the short-term benefits should be overlooked.
10. The company has no data backup mechanism and recovery system.
The company is not prepared in the event of data losses with a proper data backup and
recovery plan. The data is vulnerable to many data losses ways such as ransomware, spyware,
viruses, server outages, accidental and intentional deletion of data and network crash. Even
though eliminating the backup and recovery plan during project design cuts down the budget,
it becomes a very risky move.
Solutions.
A backup system should be installed with a standalone backup server for storage of
the company data.
A disaster recovery program should be designed and deployed in preparedness for
unfortunate events involving data losses.
11. Rare Vintage Auto Parts Ltd has not provided its management and employees a
network security policy and guidelines.
The company lacks a nicely documented network usage and management policy. The
policies are written to guide the employees on how the network should be used with the
privileges allowed. The security protocols should be easy to understand and enforce. In order
to protect the company’s data and network components, Rare Vintage Auto Parts Ltd needs
to document a security policy to guide its employees. The security policy documents the
rights of the employees with regard to how they use the network, the benefits, acceptable use
of the computers, internet access, passwords and data stored and transmitted within the
network system. Furthermore, the policy documents the response in the event of attacks, data
losses and unacceptable use of the network and network components, Bulbul et al (2008).
Solutions.