A Rogue Access Point is an unauthorized wireless device that acts as a gateway to your internal network. They are typically attached to an open network port in an empty office or cubicle, but may be setup anywhere that an open and active network port can be found. During our wireless assessments we always include a check for rogue access points. We recommend that our clients check for Rogue Access Points on at least a quarterly basis if real-time wireless IDS tools like AirDefense are not in place. Note that these checks need to be done regardless of whether the organization has deployed a wireless network, as the threat posed from rogue access points exists independent of this decision. In fact, rogue access points are more likely to appear in environments where wireless networks are not in-use, making these checks even more critical.

What is the risk posed by Rogue Access Points?

Because these devices are not authorized or put through any level of scrutiny by IT they are often implemented with little to no security. The result is unfettered access to your network by anyone within range of your building. This is like installing a network jack to your internal network in the parking lot or in another tenant's office space. Rogue access points are a common attack vector when a company is specifically being targeted, but also may be discovered by attacker scouting an area looking for unsecure wireless networks (a practice known as "war-driving").

How do Rogue Access Points make their way into a network?

Rogue access points are typically setup by technically savvy business users, often with benign intent. Typically these users are familiar with wireless connectivity in their homes, and want the same ease of use and mobility in the office. Usually, these users do not understand the security implications involved. In environments that already have a wireless network, they may wish to bypass authentication controls or other security to support a personal device that they wish to use on the network. In other, less common cases, Rogue access points may be put in-place for nefarious or malicious purposes by disgruntled employees, contractors or anyone else with physical access to the network.

What can I do about Rogue Access Points?

InfusionPoints can help you by assessing your wireless infrastructure and wireless security controls in place, and will create a plan of action to help you implement the controls needed to counter the threat posed by Rogue Access Points and other wireless security threats. Look for future blog posts where we will be covering how to continuously monitor your airspace for wireless threats. Also, look for an upcoming post where I will describe how we conduct our checks for Rogue Access Points during our wireless assessments.