CSG 5308: Wireless Security Risk Analysis and Solutions for Auto

This report investigates the wireless security vulnerabilities affecting Rare Vintage Auto Parts Ltd, a company distributing automotive parts. The investigation identifies issues such as weak WEP encryption, broadcasting SSID, incorrect antenna types, absence of firewall and VPN, lack of network policies, and mixed network card standards. The report proposes countermeasures including upgrading to WPA, implementing unidirectional antennas, disabling SSID broadcast, using access points with similar power levels, deploying firewalls and VPNs, establishing security policies, and implementing a BYOD policy. The report also includes a risk assessment matrix and recommendations for hardware and software deployment to enhance network security. Desklib provides access to similar reports and study resources for students.

WIRELESS SECURITY
Wireless Security
NAME
COURSE
UNIVERSITY/AFFILIATION
sTUDENT NAME 1

WIRELESS SECURITY
Abstract
This report addresses some of the security issues that affects Rare Vintage Auto Parts Ltd.
Some the issues include the following; wireless system, links, tills and the deployment of the wireless
networks that can enhance sharing of data and information between different departments within the
company. The following are some of the issues that were identified; poor network and data encryption,
a wireless network that broadcasts its SSID, the network connection had no firewall nor a virtual
private network, no procedures and policies guiding the network and a mixture of network data cards
among others. The report has also discussed some of the solutions that should be used to strengthen the
network security and policies including software and hardware deployment with the Bring Your Own
Device policy.
sTUDENT NAME 2
STUDENT NAME STUDENT ID

WIRELESS SECURITY
Table of Contents
Abstract.................................................................................................................................................................2
Introduction..........................................................................................................................................................3
Methodology.........................................................................................................................................................3
Findings of the Investigations..............................................................................................................................4
i. Wired Equivalent Privacy (WEP) encryption........................................................................................6
i. Using Incorrect Antenna Type................................................................................................................7
ii. Incorporation of Service Set Identifier (SSID) into the wireless Connection Technology by the
Company...........................................................................................................................................................8
iii. Access Points with Higher Power Gains.............................................................................................8
iv. Absence of Firewall and Virtual Private Network (VPN).................................................................9
v. The network is not Subnet for all the Devices......................................................................................10
vi. Lack of written policies on security and procedures in the company.............................................10
vii. Absence of designated and back up router on network...................................................................11
viii. Combining Different Network Cards Standards.............................................................................11
ix. Absence of enterprise backup and recovery management program...............................................12
Appropriate Counter Measures........................................................................................................................13
Disclaimer.......................................................................................................................................................15
User acknowledgment and agreement..........................................................................................................16
References...........................................................................................................................................................17
sTUDENT NAME 3
STUDENT NAME STUDENT ID

WIRELESS SECURITY
Introduction
Rare Vintage Auto Parts Ltd is a company that deals with the distribution of different parts of
motor vehicle to many consumers ranging from car mechanics to the motor vehicle manufacturing
industries. The business consists of several stores that are integrated with the main office. Management
of each store can obtain several parts of motor vehicles through sending an inventory to the main office
by using a mobile phone. However, there are some security issues that have been discovered by the
management of the business, and subsequently, requested for an investigation aiming at addressing
some of the security issues. For instance, Information Technology (IT) manager accessed some of the
illicit information 30 days ago, which forced the company to dismiss him.
Afterwards, IT administrator was replaced with unskilled IT personnel, and subsequently,
network connection of Cottesloe shop failed to function on the same day. Also, network connection
between Kalamunda and Joondalup stores experienced some problems. Following these developments,
it became necessary for company management to issue a directive for investigations concerning the
smooth running of the business operations. In addition, some of the security issues that affects wireless
technology have also been examined in detail. Some of the issues includes the following; using Wired
Equivalent Privacy (WEP) encryption for data security that is susceptible to attacks and antivirus only
without firewalls for protection of data.
Methodology
There are many methods and techniques that are used to collect data and information, for
example, observation, interviewing, questionnaire and surveys. Regarding to this research, data and
information were collected using the following methods; observation, interviewing and testing
alongside some secondary sources such as relevant documents(Alshenqeeti, 2014).
Interviewing is associated with the process by which an interviewer asks an interviewee some
questions regarding to a certain event that has taken place or the functionality of the specific system.
For instance, in this context, more than 20 employees were asked some questions regarding to the
functionality of the wireless connection alongside some of the problems that are encountered while
using the system (Alshenqeeti, 2014). On the other hand, observation is the process of observing
keenly how a certain system is used to perform its intended duties in the company or an organization.
Hence, the functionality of wireless technology was observed keenly aiming at discovering some of the
sTUDENT NAME 4
STUDENT NAME STUDENT ID

WIRELESS SECURITY
problems that are encountered by the employees, while using the wireless technology (Suen&Ary,
2014).
Furthermore, some of the secondary sources were also used in collecting data and information.
Secondary sources are used to supplement primary sources of information. These sources are
developed from the primary sources by people (Johnston, 2017). Some of the examples of secondary
sources includes the following; books, magazines and newspapers. In this context, some of the files
that were used by the former IT manager were examined and analyzed aiming at acquiring some
information about security issues that were affecting wireless connection technology. Lastly, network
connection was tested to ascertain if the wireless technology was functioning correctly basing on its
predetermined goals and objectives (Navarro & Cho, 2016).
Findings of the Investigations
T
H
RISK HARSHNESS.
ACCEPTABLE TOLERABL
E
UNDESIRABLE INTOLERABLE
LOW CHANCES OF Data is lost Network tools Network Malfunctioning
sTUDENT NAME 5
STUDENT NAME STUDENT ID

WIRELESS SECURITY
E
C
H
A
N
C
E
S
O
F
R
I
S
K
O
C
OCCURRENCE because of the
absence of
backup
techniques, for
example, cloud
storage.
and
equipment are
incorrectly
used due to
lack of rules
and
regulations.
connection
errors because of
the absence of
routers.
of the network
because of not
dividing the
network into
several portions
usually referred
to as subnetting.
HIGH CHANCES OF
OCCURRENCE
Attack because
of the absence
of intrusion
protection and
detection
mechanisms.
Low
performance
because of
integrating
several
network
cards.
Network
connection
errors because of
high power gain
APs.
Attack because
of broadcasting
SSID.
VERY HIGH
CHANCES OF
OCCURRENCE
Vulnerability to
attacks because
of the absence
of virtual
private network
(VPN) and
firewall for data
security.
Low
performance
because of
incompatible
antenna.
Destruction of
data and
information
because of the
absence of
firewall.
Attack because
or poor
concealing of
data and
information.
sTUDENT NAME 6
STUDENT NAME STUDENT ID

WIRELESS SECURITY
C
U
R
R
i. Wired Equivalent Privacy (WEP) encryption.
Data encryption is very essential in protecting company’s data and information against
unauthorized access alongside other access control mechanisms such as using of username and
passwords. There are many ways on which data can be encrypted, for example, hashing and symmetric
methods. Data was encrypted using WEP in Rare Vintage Auto Parts Ltd company. WEP was created
by IEEE as one of the standards for preventing intruders from accessing data and information that is
shared between different users (Asuncion & Guadalupe, 2017).
sTUDENT NAME 7
STUDENT NAME STUDENT ID

WIRELESS SECURITY
The following are some of the weaknesses that are associated with WEP encryption that was adopted
by Rare Vintage company:
 Rivest Cipher (RC4) was not configured correctly. One of the major principles
underlying adoption of RC4 is that there should be no any key that need to be used more
than once. For instance, Initialization Vector (IV), which is a number that can be
integrated with a unique key for concealing data and information is used more than
once. Hence, making it easy for an intruder to access some of the repeated keys.
 In addition, key scheduling algorithms of WEP were identified and published. This
algorithm was identified using some of the tools, for example, Air Snort (Asuncion &
Guadalupe, 2017).
Mitigation
 Protection of internet connections of the company using modern technologies, for
example, Wi-fi Protected Access (WPA).
 Enhancing the use of access control mechanisms, for example, username and passwords
for allowing right user of the network to gain access to a certain data and information,
hence preventing hackers from accessing the data without user’s consent and permission
(Asuncion & Guadalupe, 2017).
i. Using Incorrect Antenna Type
Rare Vintage Auto Parts Ltd uses distinct types of antennas. For instance, 16Dbi Omni-
directional and 6dBi antennas have been deployed. Antennas are divided into three major categories
which include the following; omni-directional, semi-directional and directional antennas (Do,
Moeglein, Gao & Zhang, 2017). These three antennas are differentiated by using specific directions
that they can be applied.
sTUDENT NAME 8
STUDENT NAME STUDENT ID

WIRELESS SECURITY
For instance, omni-directional antenna can be used in all angles i.e. 360 degrees. On the other hand,
semi-directional antennas can be used in a certain angle that has been identified in advance. In addition,
directional antennas can be used in any specified directions. Parabolic is one of the common examples
of directional antennas. Directional antennas have some distinct properties, thus making it possible to
be used in different contexts (Do et al., 2017).
Solutions
 Incorporation of unidirectional antennas into wireless connections of the company, for example,
a satellite dish.
 Adopting of antennas with the same frequencies, thus enhancing consistency in sharing of data
and information between different departments or stores within the company.
 Reducing physical obstructions between different employees and departments by enabling
direct interaction between the sender and the receiver of the information and data (Do et al.,
2017).
ii. Incorporation of Service Set Identifier (SSID) into the wireless Connection
Technology by the Company.
SSID is associated with naming of a wireless network, hence allowing several sections or
departments within a company to be linked with a lot of ease. The name of the wireless network is
always different from the other wireless networks in the same geographical region. For instance, a
company can have more than one wireless networks, therefore, SSID can be used to differentiate
between different networks for easy connection (Klein &Barbash, 2018). There are many challenges
and problems that are encountered while using SSID in wireless technology. Some of the problems
includes the following:
 Concealing a wireless network using SSID is a waste of time since the hacker or an
intruder can access the network with a lot of ease. For instance, there is no any data
security mechanisms, for example, firewall in Rare Vintage Auto Parts Ltd.
 The specific or unique name of a wireless network can be accessed easily. For
instance, NetStumbler is one of the computer soft wares that can be used by the
intruder to show all the names of the wireless networks that are available at a specific
geographical area. Also, tools like Aircrack can be used by an intruder to identify a
given SSID of a wireless network (Klein &Barbash, 2018).
sTUDENT NAME 9
STUDENT NAME STUDENT ID

WIRELESS SECURITY
Solutions
 Modification of router passwords alongside other details of the network in case
any employee has resigned or dismissed from the company.
 Disabling SSID, hence making it difficult for an intruder to gain access of a given
wireless network without the consent of the user and permission.
iii. Access Points with Higher Power Gains
The rate of increasing the signal strength is directly proportional to the rate of power increase,
hence reducing unnecessary interference, while using wireless connections. However, there are some
challenges that are associated with increasing the power of the access points. Some of the challenges
and problems includes the following; 1) limited space or area for accessing wi-fi signal and 2) receivers
with low power cannot send data to the access points, hence affecting the entire communication
process (Islam et al., 2017).
Solutions
 Reducing the number of access points by using low power gains (APs) aiming at
increasing the space or the area that can be felt by the connection signal.
 Using access points having similar power level with other devices, for example,
receivers aiming at enhancing continuous flow of communication within the company
(Islam et al., 2017).
iv. Absence of Firewall and Virtual Private Network (VPN)
A firewall is a wall that protects data and information against unauthorized access by the outsiders or
hackers. Firewall checks all the files and messages that are send and received within a given network,
hence making it difficult for any person to send malicious files across a given network. Internet
connection is one of the necessities for sending and receiving data within the company or the outside
world, therefore, increasing many risks such as virus and worms that are associated with the internet
(Williams, Lohner, Harmon & Bower, 2015).
sTUDENT NAME 10
STUDENT NAME STUDENT ID

WIRELESS SECURITY
Following these developments in wireless network connections, it becomes very difficult to protect a
network against attacks using antivirus solutions only, for example, windows defender, Avast and
Avira antiviruses. Broadcasting of SSID in Range Vintage Auto Parts Ltd company makes it possible
for any person to access its network remotely. Also, there are no any network protection mechanisms,
for example, VPN, hence the network is visible to the outside world and it can be accessed with a lot of
ease without struggling. Furthermore, the absence of Intrusion Detection Mechanism (IDS) has made it
impossible for the IT team in realizing when the wireless network is accessed by an unauthorized
person within the company or outside (Williams et al., 2015).
Solutions
 Installation of firewall, therefore, preventing unauthorized people from accessing company’s
wireless network.
 Deployment of Intrusion Detection Mechanism (IDS) for detecting any person entering in the
wireless network without unauthorized access or user’s consent.
 Using Virtual Private Network for concealing company’s wireless network from the outside
world (Williams et al., 2015).
v. The network is not Subnet for all the Devices
The broadcast domain connection is that all the devices are interconnected using the same
subnetwork for all the infrastructure in which it causes network congestion thus communication
becomes slow and network capability speed is also reduced. The operations are on the same subnet in
broadcast domain.
sTUDENT NAME 11
STUDENT NAME STUDENT ID

WIRELESS SECURITY
Data and information are sent to all the devices that are connected in the Wireless Local Area Network
(WLAN). The WLAN functionality can be affected in case all the interconnected devices within the
WLAN generates undesirable messages commonly referred to as spamming, therefore, affecting the
entire performance of the WLAN. Securing of the company’s network is a bit tricky, since there are
various IP addresses of different devices within the company using the same subnetwork (Vershkov et
al., 2016).
Resolutions
1. Ensuring that all the devices within the network have been designated from one another by
using different identification numbers (IDs).
2. Separating different subnetworks for easy identification of network regions, for example, host
and the subnet. This can be achieved by using several tools such as 32-bit key.
3. Allocating different subnet masks to different devices, therefore, enhancing uniformity in
network connection and increasing the rate of the network connection (Vershkov et al., 2016).
vi. Lack of written policies on security and procedures in the company
All the organizations and companies that rely on network connection must have principles and
policies that should be stated explicitly for governing the entire network systems. For instance, all the
principles and policies must be recorded, therefore, fostering the ease of implementation by the
company management (Peltier, 2016). Hence, ensuring that all the policies have been followed strictly
by all the company employees. For easy enforcement, all the policies must be easily comprehended by
relevant company employees, for example, the director and IT administrator of the company. The chief
purpose of security policies is to ensure that all the components that constitutes a given wireless
network, for example, laptops, ethernet cables and computers alongside data and information are
protected. In addition, security policies also explain how several enterprises within the company must
be governed and controlled, for instance, the procedures for setting email passwords and storing of data
and information are determined in advance. Furthermore, some of the ways on which some of the
sTUDENT NAME 12
STUDENT NAME STUDENT ID