Wireless tip: Don't hide from risk

The best wireless network security is to not have a wireless network, according to Defense and intelligence experts who spoke today at a conference in Washington, D.C., sponsored by E-Gov, which is part of FCW Media Group.

But because that is not always a practical solution, they offered other tips to keep intruders out of the network and to keep data safe.

Perhaps the most important safety precaution is acknowledging the risk, said Kevin Marlowe, acting director of systems network engineering at the Joint Systems Integration Command, a subcommand of the U.S. Joint Forces Command.

"Calculate the risk, figure out whether you can accept that risk and mitigate it," he said.

"Risk doesn't have to be zero for us to use a product," said Timothy Havighurst, a systems architect at the National Security Agency. "Sometimes the convenience of these systems outweighs the risks."

No wireless device or network can ever be completely secure, said Atul Prakash, a professor at the University of Michigan's electrical engineering and computer sciences division.

Ask a vendor representative if a product is completely secure, he said. "If they say yes, you're probably talking to a marketing guy or a salesman," he said. "If you're talking to a security expert, they will hedge."

Agency officials must deal with the real world of commercial technology, Havighurst added. "Soon you will not be able to buy a laptop without" wireless connectivity, he said. "Soon you will not be able to buy a [wireless] phone without a camera. These are things we disallow, but industry is moving on."

Agency employees sometimes push their bosses to move faster in technology adoption, he said. When managers set a policy forbidding some wireless devices, employees will often argue that operational need justifies changing the rules.

"Sometimes those are legitimate reasons," Havighurst said. "Sometimes they're not. Sometimes they just want something because it's really cool."

Marlowe offered a list of tips for making wireless networks safer, including:

Change factory settings in the routers. Hackers know the common default passwords and other information that makes intrusion easy if they're not changed.

Enable the router's session timeout feature so that if no data passes through it after a set period of time, it shuts down.

Set routers to the lowest feasible power, so they keep the network devices connected without opening the door wider than necessary.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.