2008-04-29 23:55:11 -
www.airdefense.net - AirDefense Kristin Callaway, 770-843-5256 kcallaway@airdefense.net or Schwartz Comm. for AirDefense Bill Keeler/Melissa Chan, 781-684-0770 airdefense@schwartz-pr.com AirDefense, the innovator that launched the wireless LAN security market, and the first company to conduct wireless security vulnerability studies in industries such as retail, healthcare, financial services, government, transportation and the Fortune 500, today unveiled
results from its comprehensive study of the wireless airwaves at hundreds of Las Vegas retailers and hotels/casinos. AirDefense found the majority of retailers in Las Vegas using strong encryption protocols to protect data with 65 percent of the 640 Access Points (APs) discovered encrypted with Wi-Fi Protected Access (WPA) or WPA2. In stark contrast, 82 percent of the 1,557 APs discovered in Las Vegas hotels/casinos were using either no encryption or Wired Equivalent Privacy (WEP), the weakest protocol for wireless data encryption.
For more information on AirDefense's Las Vegas Wireless Security Study, stop by to the company's booth #807 at Interop Las Vegas, April 29-May 2, Mandalay Bay Convention Center or call Bill Keeler at 781 684-0770.
AirDefense conducted its study of retail shops, hotels/casinos by capturing the data as it leaked out of the buildings. While consequences of the wireless security vulnerabilities found in AirDefense's Las Vegas study are difficult to quantify, unauthorized individuals with a desire to steal consumer information, retailer data or to disrupt networks are likely to look for the weakest link in the network, such as mis-configured access points.
AirDefense's recent retail survey in San Francisco illustrates a trend of enhanced wireless security protocols in place as more than 60 percent of retailers use WPA or WPA2. For more information, log onto:
www.airdefense.net/newsandpress/04_04_08.php. Retailers in Las Vegas and San Francisco are using enhanced encryption protocols well above the national average of 49 percent found in AirDefense's groundbreaking "2007 Retail Shopping Wireless Security Survey" unveiled in November 2007:
www.airdefense.net/newsandpress/retail_pressrelease.php.
On the downside, many instances were discovered where retailers continue to use their store name in the Service Set Identification (SSID). An SSID is the name assigned by the equipment vendor to the wireless network during installation. SSIDs can easily be reconfigured but often times are not. Store SSIDs emit a broadcast signal for potential intruders to quickly pick up and fraudulently connect to default settings that haven't been changed. In addition, AirDefense discovered high levels of data leakage as wireless functionality was added and left unprotected increasing the risk of exposing point-of-sale information and consumer credit card information.
"What was most surprising in studying hundreds of locations in Las Vegas is that as serious as retailers are taking wireless security today, the same can't be said in the majority of hotels/casinos as most are making a poor attempt to secure wireless communications," said Richard Rushing, chief security officer, AirDefense. "The most egregious findings were unencrypted APs set up to give hotel/casino guests Wi-Fi access, but at the same time giving intruders an opening to expand their beach head to troll for sensitive customer or corporate data."
Additional Retail Study Anecdotes:
-- A greater number of high end retailers are offering free wireless to customers, inviting more traffic into stores. However, many consumers simply fail to turn on the encryption features of their personal wireless devices.
-- Poor selection of SSID or use of default SSID for applications such as "POSwireless" and "Air Retail."
Additional Hotel/Casino Study Anecdotes:
-- Rogue APs present a huge threat with many interference and performance issues percolating creating the perfect cover for hackers.
-- Unencrypted and encrypted wired sided leakage of security protocols (Spanning Tree, HSRP, CDP, VTP, DTP, VRRP, and NetBios, is a critical problem in the hotels and casinos as a leaking path is not just one way, it's bi-directional, what leaks out can leak back in.
-- Many of the hotels/casinos have deployed some of the newest wireless switches and AP hardware and are some of the only sites discovered to be using 802.11a.
-- Hotels/casinos along the strip are battling between high powered outdoor wireless networks and internal wireless networks.
-- A minimal amount of mis-configured APs were discovered as had been seen in past surveys. However, Linksys, Netgear and Dlink were found playing the role of rogue APs.
-- Numerous interference and performance problems were discovered with the wireless networks throughout the city.
About AirDefense
AirDefense is the market leader in anywhere, anytime wireless security. The company is trusted by more Fortune 500 companies, healthcare organizations and high-security government agencies for enterprise wireless protection than any other company. AirDefense products provide the most advanced solutions for rogue wireless detection, policy enforcement and intrusion prevention, both inside and outside an organization's physical locations and wired networks. Common Criteria-certified, AirDefense enterprise-class products scale to support single offices as well as organizations with hundreds of locations around the globe. Founded in 2001, AirDefense is based in Atlanta, GA, and serves 700 government agencies and blue chip corporations. For more information, please visit
www.airdefense.net or call 770.663.8115.
AirDefense Finds Retailers Making a First-Rate Effort to Secure
Their Wireless Networks While Hotels/Casinos Are Lagging Well Behind
in the Same Task
