WiMax Operator's Manual

192 CHAPTER 9 ■ NETWORK SECURITY
approaches. But currently, encryption remains a powerful preventive tool for the security
administrator.
Finally, within the arsenal of defensive procedures, some software engines are designed
not only to detect malicious code but also to prevent its effects by restoring network data to its
state just prior to the detection of suspicious activity. Such software is a fairly new development,
and it may not be entirely effective against all conceivable attacks.
Authentication is sometimes considered a part of security and sometimes just a part of
routine network operations. In a wireless network authentication, the process by which network
users demonstrate that they are who they purport to be is especially important because
the physical layer of the network is essentially open. Authentication today is normally performed
in specialized servers, most of which now run Radius software.
Safeguarding Network Elements from Hijacking and
Malicious Code: Best Practices
Securing network elements is, of course, vital to the integrity of the operation. While direct
attacks on equipment operating systems intended to disable networks for lengthy intervals are
not at all commonplace, intrusions into management systems have occurred in the past and
undoubtedly will occur in the future. Obviously, they should be prevented at all costs. Unfortunately,
many of today’s network elements are more vulnerable than the telco “big iron” of
the past. Telephone circuit switches and asynchronous transfer mode (ATM) switches generally
utilized some variant of Unix as an operating system and involved extremely arcane code
that few hackers ever mastered. Indeed, most of the people who successfully hacked into
telephone central offices were experienced individuals working in telecommunications. In
contrast, many network devices manufactured today use open or commonly understood platforms
such as Linux, Windows NT, or Java. They may incorporate some type of software
firewall to thwart intruders, but they are not inherently difficult to understand or manipulate.
And because wireless transmissions can be physically intercepted with great ease, there is little
physical layer security possible in the network, and the network operator must remain largely
dependent on specialized security software.
The danger is compounded because most equipment today is designed to permit remote
management by an authorized network administrator from a supposedly secure Web site.
Obviously, that greatly eases the job of network administrators, enabling them to respond to
problems in the network anywhere and at any time without having to visit the central office.
However, if the administrator can access the OSS suite, then so can a hacker—if that individual
can get past whatever security measures are in place. Accordingly, the network operator must
make certain that there are no “trap doors” permitting entry into the management system that
bypass authentication measures.
Denial-of-Service Attacks: A Special Case
Denial-of-service (DoS), or flooding attacks, have been used for many years by hackers. They
are launched by capturing a large number of terminals and using them to transmit meaningless
messages that flood the public network affected beyond its carrying capacity.
DoS attacks are different from viruses and worms. They do not introduce malicious
code into network elements or management software, and they are transitory in their effects.
And yet they can shut down a network effectively for hours. Recently several vendors have