MSIT 458: Security (Professor Chen)
Party of Five
Brandon Hoffman
Kelly Koenig
Azam Masood
Phil Nwafor






The Need
Alternatives Considered
Our Solution (Technical Detail)
Real World Example
Q & A

With the increase in usage of wireless-based technologies, security has formulated a substantial focus of IT departments globally.
Many considerations need to be made to ensure the system is:



Effective
Efficient
Easy for end users and administrators




Secure network platform with integrated security that is scalable to advanced security technologies and services
Threat control services focused on antivirus protection and policy enforcement.
Secure communication services that maintain privacy and confidentiality of sensitive data.
* Cisco Systems






 Rapidly identify and respond to evolving threats
Enforce business policies
Protect critical assets
Decrease complexity
Ease the administrative burden of IT
Lower total cost of ownership




The current wireless security implementation is effective but manually intensive.

Wireless users need to have an account created manually
The accounts expire and need manual attention
The credentials for wireless require a PAC (certificate) to access the system that must be manually installed
The wireless users authenticate to an island as opposed to the enterprise Identity Vault

*Culled from Secure Wireless: Integrity of Information on the Move (Cisco Paper)

*Culled from Secure Wireless: Integrity of Information on the Move (Cisco Paper)

*Culled from Secure Wireless: Integrity of Information on the Move (Cisco Paper)




WPA & WPA2:
Designed as a stop gap between WEP and 802.1x (EAP) development.
The most common mode of WPA2 is pre-shared key.
Enterprises need a more distributed model.

EAP (Extensible Authentication
Protocols) were created because a pre-shared key model does not make sense with hundreds or thousands of wireless clients.
Wireless Admin using PSK

There are many variations of EAP types. Some are no longer widely used due to imperfections.
 LEAP- Modified version of MS-CHAP. No credential protection. No native Windows Support
 PEAP- Joint venture between Cisco and Microsoft.
Similar to EAP-TTLS by using PKI server side certs.
Users will only know PEAPv0. PEAPv1 includes different inner authentication mechanisms.

 EAP-(T)TLS - Uses PKI to communicate securely with
RADIUS or authentication server. Requires client cert.
TTLS only requires server cert. Convenience vs.
Security.
 EAP-IKEv2 – Mutual authentication and session key establishment. Supports Passwords, Asymmetric, or
Symmetric keys. Can utilize different methods in each direction. EXPERIMENTAL.
 EAP-FAST
– Provides multiple secured tunnels. Flexible inner methods for authentication. Exploits TLS without inconvenience of manual client side certs.

The many varieties of EAP that have evolved can be quickly evaluated for specific, enterprise desirable benefits by viewing the charts below

EAP-FAST is a Cisco proprietary 802.1x authentication scheme. It contains a feature called “automatic PAC” that allows the system to manage and maintain the user certificates. The mechanism boasts the following features:




Utilizes a series of secure tunnels for credential transport
Leverages existing user credentials and authentication back-end
(Radius AAA, and LDAP/IdM3)
Encrypts wireless data with leading edge encryption methods such as WPA2 AES-CCMP
EAP-FAST is a triple phase authentication mechanism

Phase zero is essential to the automatic PAC creation process.
 EAPFAST requires the use of Cisco’s ACS server


Phase zero has several custom radius elements and wireless client components
Phase zero consists of the ACS server opening and SSL tunnel with the client


It then checks the credentials sent via GTC (for generic LDAP) against the enterprise identity system
If valid it creates a PAC and sends it to the client.

Phase one is where the ACS server and the client setup the TLS tunnel.
 The client sends a Hello message to the server



The server responds with a variety of information
The client checks the info and sends its encrypted PAC file to the server for mutual authentication
Once completed the master secret is generated and the TLS tunnel is opened. At this point, Phase Two may now commence.

Phase two is very simple.
 The TLS tunnel is already established, the client simply sends its unencrypted credentials to the
ACS server
 The ACS server forwards the information to the
LDAP server and upon a positive response grants network access.

Large Telecommunications Company
CHALLENGES



Provide a unique access point for guests and employees.
Provide employees with a similar end-user experience to the one they have now
(transparency)
Reduce maintenance related costs incurred by IT department

Large Telecommunications Company
SOLUTION




EAP-FAST as opposed to LEAP solution
Less susceptible to dictionary attack since there is less of a reliance on user’s password strength.
Employ the additional security that EAP-
FAST provides through ‘tunneling.
Like LEAP, eschews digital certificate need.

Large Telecommunications Company
RESULTS




More secure and cost-effective client access
Tunneling affords less reliance on user passwords by authenticating only after tunnel is established.
Most of this remains transparent to the user.
Repeatable/Predictable and consistent client experience.

Healthcare Case Study

CHALLENGES
Lifespan Healthcare emerged as a result of the merger of two of the largest acute care facilities in Rhode Island
 Wireless technology was critical strategic and tactical element to support care delivery.


Authentication of mobile clients from two large institutions was a challenge.
Mobile diagnostic devices had to be tethered to Ethernet which was usually logistically inconvenient.

Healthcare Case Study
SOLUTION (Same as previous)




EAP-FAST was visited as an authentication alternative due to some of its inherent benefits.
Less susceptible to dictionary attack since there is less of a reliance on user’s password strength.
Employ the additional security that EAP-
FAST provides through ‘tunneling.
Like LEAP, eschews digital certificate need.

Healthcare Case Study
RESULTS



The goal was achieved through simplified authentication, via EAP-FAST enabling secure mobility to clinical systems.
Facilitated point-of-care functions to physicians and other clinicians anytime, anywhere.
More secure and cost-effective client access



Secure Wireless: Integrity of Information on the Move, http://www.cisco.com/en/US/solutions/collateral/ns340/n s394/ns348/ns386/net_presentation0900aecd805febbb.
pdf (Cisco)
The Business Case for Enterprise-Class Wireless LANS http://safari.oreilly.com/1587201259/gloss01lev1sec6#X2ludGVybm
FsX1RvYz94bWxpZD0xNTg3MjAxMjU5L2NoMTA=