Wireless Security Is Different

W ireless network security based on the IEEE 802.11 standard has received a lot of negative attention over the past few years. The attention was warranted, but 802.11 certainly wasn’t the only product to suffer from poor security. For example, operating systems and browsers have also posed significant security problems. Why then did Wi-Fi–based networks become such a lightning rod for criticism? First, there was the exponential adoption rate of the technology. Further, the security architecture did not define a threat model or security goals and was developed by a relatively closed standards body without public review or involvement of a security professional. Of course, the security architecture for Wi-Fi networks was also the unluckiest I’ve ever seen. If anything could go wrong, it did. But most of the time you make your own luck—or at least set yourself up for it. Unfortunately, 802.11 was not set up for lucky breaks—just breaks, and not the kind that security professionals like to see. I won’t go through the litany of problems with 802.11-based networks as they are well covered elsewhere (www.cs.umd.edu/~waa/wireless.html and www.drizzle.com/~aboba/ IEEE/). Instead, I want to convince you that wireless security requires slightly different thinking from wired security. In other words, wireless security is different—and not just misunderstood.