Wireless Network Security: 802.11, Bluetooth and Handheld Devices
Total Page:16
File Type:pdf, Size:1020Kb
Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Archived Publication Series/Number: NIST Special Publication 800-48 Title: Wireless Security: 802.11, Bluetooth and Handheld Devices Publication Date(s): November 2002 Withdrawal Date: July 2008 Withdrawal Note: SP 800-48 is superseded in its entirety by the publication of SP 800-48 Revision 1 (July 2008). Superseding Publication(s) The attached publication has been superseded by the following publication(s): Series/Number: NIST Special Publication 800-48 Revision 1 Title: Guide to Securing Legacy IEEE 802.11 Wireless Networks Author(s): Karen Scarfone, Derrick Dicoi, Matthew Sexton, Cyrus Tibbs Publication Date(s): July 2008 URL/DOI: http://dx.doi.org/10.6028/NIST.SP.800-48r1 Additional Information (if applicable) Contact: Computer Security Division (Information Technology Lab) Latest revision of the SP 800-48 Revision 1 (as of August 7, 2015) attached publication: Related information: http://csrc.nist.gov/ Withdrawal N/A announcement (link): Date updated: ƵŐƵƐƚϳ, 2015 Special Publication 800-48 Wireless Network Security 802.11, Bluetooth and Handheld Devices Tom Karygiannis Les Owens NIST Special Publication 800-48 Wireless Network Security 802.11, Bluetooth and Handheld Devices Recommendations of the National Institute of Standards and Technology Tom Karygiannis and Les Owens C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 November 2002 U.S. Department of Commerce Donald L. Evans, Secretary Technology Administration Phillip J. Bond, Under Secretary for Technology National Institute of Standards and Technology Arden L. Bement, Jr., Director WIRELESS NETWORK SECURITY Note to Readers This document is a publication of the National Institute of Standards and Technology (NIST) and is not subject to U.S. copyright. Certain commercial products are described in this document as examples only. Inclusion or exclusion of any product does not imply endorsement or non-endorsement by NIST or any agency of the U.S. Government. Inclusion of a product name does not imply that the product is the best or only product suitable for the specified purpose. Acknowledgments The authors wish to express their sincere thanks to numerous members of government, industry, and academia who have commented on this document. First, the authors wish to express their thanks to the staff at Booz Allen Hamilton who contributed to this document. In particular, their appreciation goes to Rick Nicholson, Brendan Goode, Christine Kerns, Sharma Aditi, and Brian Miller for their research, technical support, and contributions to this document. The authors express their appreciation to Bill Burr, Murugiah Souppaya, Tim Grance, Ray Snouffer, Sheila Frankel, and John Wack of NIST, for providing valuable contributions to the technical content of this publication. The authors would also like to express their thanks to security experts Russ Housley, Markus Jacobsson, Jan-Ove Larsson, Simon Josefsson, Stephen Whitlock, Brian Seborg, Pascal Meunier, William Arbaugh, Joesph Kabara, David Tipper, and Prashanth Krishnanmurthy for their valuable comments and suggestions. Finally, the authors wish to thank especially Matthew Gast, Keith Rhodes, and the Bluetooth Special Interest Group for their critical review and feedback during the public comments period. Contributions were also made by Rick Doten, Jerry Harold, Stephen Palmer, Michael D. Gerdes, Wally Wilhoite, Ben Halpert, Susan Landau, Sandeep Dhameja, Robert Moskowitz, Dennis Volpano, David Harrington, Bernard Aboba, Edward Block, Carol Ann Widmayer, Harold J. Podell, Mike DiSabato, Pieter Kasselman, Rick E. Morin, Chall McRoberts, and Kevin L. Perez. i WIRELESS NETWORK SECURITY Table of Contents Executive Summary................................................................................................................. 1 1. Introduction ................................................................................................................... 1-1 1.1 Authority ................................................................................................................ 1-1 1.2 Document Purpose and Scope .............................................................................. 1-1 1.3 Audience and Assumptions ................................................................................... 1-2 1.4 Document Organization ......................................................................................... 1-2 2. Overview of Wireless Technology................................................................................ 2-1 2.1 Wireless Networks................................................................................................. 2-1 2.1.1 Wireless LANs ........................................................................................... 2-1 2.1.2 Ad Hoc Networks ....................................................................................... 2-1 2.2 Wireless Devices ................................................................................................... 2-2 2.2.1 Personal Digital Assistants......................................................................... 2-2 2.2.2 Smart Phones ............................................................................................ 2-3 2.3 Wireless Standards................................................................................................ 2-3 2.3.1 IEEE 802.11............................................................................................... 2-3 2.3.2 Bluetooth.................................................................................................... 2-3 2.4 Wireless Security Threats and Risk Mitigation ....................................................... 2-4 2.5 Emerging Wireless Technologies........................................................................... 2-6 2.6 Federal Information Processing Standards ............................................................ 2-6 3. Wireless LANs ............................................................................................................... 3-8 3.1 Wireless LAN Overview ......................................................................................... 3-8 3.1.1 Brief History ............................................................................................... 3-8 3.1.2 Frequency and Data Rates ........................................................................ 3-9 3.1.3 802.11 Architecture.................................................................................... 3-9 3.1.4 Wireless LAN Components ...................................................................... 3-11 3.1.5 Range ...................................................................................................... 3-11 3.2 Benefits ................................................................................................................3-12 3.3 Security of 802.11 Wireless LANs.........................................................................3-13 3.3.1 Security Features of 802.11 Wireless LANs per the Standard.................. 3-13 3.3.2 Problems With the IEEE 802.11 Standard Security.................................. 3-17 3.4 Security Requirements and Threats......................................................................3-19 3.4.1 Loss of Confidentiality .............................................................................. 3-20 3.4.2 Loss of Integrity........................................................................................ 3-21 3.4.3 Loss of Network Availability...................................................................... 3-22 3.4.4 Other Security Risks ................................................................................ 3-22 3.5 Risk Mitigation ......................................................................................................3-22 3.5.1 Management Countermeasures............................................................... 3-23 3.5.2 Operational Countermeasures ................................................................. 3-23 3.5.3 Technical Countermeasures .................................................................... 3-24 3.6 Emerging Security Standards and Technologies ..................................................3-36 3.7 Case Study: Implementing a Wireless LAN in the Work Environment..................3-37 3.8 Wireless LAN Security Checklist...........................................................................3-40 3.9 Wireless LAN Risk and Security Summary ...........................................................3-42 4. Wireless Personal Area Networks................................................................................ 4-1 ii WIRELESS NETWORK SECURITY 4.1 Bluetooth Overview................................................................................................ 4-1 4.1.1 Brief History ............................................................................................... 4-3 4.1.2 Frequency and Data Rates ........................................................................ 4-3 4.1.3 Bluetooth Architecture and Components .................................................... 4-4 4.1.4 Range .......................................................................................................