Emerging Technologies in Cyber Security

A. Describe two WLAN vulnerabilities that present risks for Alliah. One of the most obvious vulnerabilities is the access point that covers the patio area for employees. Anytime a wireless signal extends outside the walls of a building it opens that WLAN up to things like war driving. Wardriving is the act of searching for Wi-Fi wireless networks, usually from a moving vehicle, using a laptop or smartphone. (Wiki Wardriving) If the wireless network is not setup securely or configured properly an attacker could gain access to the WLAN and then have full access to the companies’ network. The second vulnerability is with the webservers being in a data center 100 miles away. There is no mention of any encrypted tunnels being in place to keep the connections secure and encrypted when connecting to those servers. This opens the traffic up to a man in the middle attack where sensitive information could be intercepted. B. Describe two mobile vulnerabilities that present risks for Alliah. The first vulnerability for presented by staff using mobile devices is comes from the five account representatives. All of them were given a laptop, tablet, and smartphone to use. So, there are 15 devices that will be connecting to public wi-fi. If these devices are not encrypted or required to use VPN that poses a big risk for the company since none of their data will be secure on these devices. The second vulnerability is these 15 devices are at a very high risk of being stolen or lost. And since the data is not secure anyone that finds these devices could potentially gain access to the companies’ sensitive data. C. Summarize the steps for mitigating each identified WLAN and mobile vulnerability To mitigate the issue with the access point for the employee’s patio area the company needs to ensure that all wireless communications are using the WPA2 AES protocol as this is the most secure wireless protocol. Another option would be for the company to implement the 802.1x authentication protocol. 802.1x is an IEEE standard for port-based network access control. (IEEE 802.1x) To mitigate the issue with the webservers being 100 miles away the company needs to implement a VPN between the data center and the Alliah office. Doing so will encrypt the data to keep it secure. To mitigate the first mobile vulnerability the company needs to secure all their mobile devices. This can be done by installing vpn software on each device. This will ensure that all traffic to and from that device is encrypted. To address the second mobile device vulnerability the company should implement a mobile device management (MDM) system so they can remotely manage all mobile devices. With an MDM in place the IT department would be able to lock and remotely wipe and device that gets lost or stolen. This will help to ensure that sensitive company data is not lost. D. Recommend preventive measures to maintain the security posture of WLAN and mobile environments in a small business. The first step that any company, small or large, should take to secure their network is to implement multi factor authentication (MFA). MFA requires the users to input their username, password and a code from a token or authenticator app on their smartphone. NIST specifies three assurance levels for digital authentication. IAL1, no identity proofing. IAL2, user must submit evidence for identity proofing, remote permitted. IAL3, user must submit biometric, no remote allowed. E. Recommend a solution for the company’s BYOD approach. According to TheBalanceCareers.com BYOD provides companies with a significant cost savings since they will not be buying phones and laptops for every employee. And typically employees take better care of the device since they own it and would be responsible for replacing it if something were to happen. BYOD also takes care of the problem of outdated technology since employees are often more motivated to pay for and upgrade their phones and laptops with the latest and greatest technology. (The Pros and Cons of a Bring Your Own Device (BYOD) to Work Policy) The company will need to make sure and have a comprehensive BYOD checklist or policy that specifies things like who eligible employees are, what devices are supported, acceptable use, device maintenance and loss. This policy needs to be clear and concise so there is no grey area as to whose responsibility it is to update the device or who is responsible for replacing a lost or stolen device. The company will need to require that all mobile devices require a password or pin or have some sort of biometric access setup on them to limit who can gain access to the device. All mobile devices will be required to have VPN software installed on them. All BYOD devices will be required to receive security and software updates automatically to ensure that they are staying updated and current.