Mac OS X Security Configuration - Office of Information Technology

Preventing RF EavesdroppingMost network environments have wired and wireless access to the network. Wirelessaccess helps businesses or organizations offer mobility to users throughout theirnetwork.Although wireless technology gives your network more flexibility with your users, it cancause possible security vulnerabilities you may be unaware of. When configuring awireless access point make sure you properly configure the security settings to preventunauthorized users from attempting to access your network.Your wireless access point should require encryption of the connection, userauthentication (through the use of certificates or smart cards), and time-outs forconnections.By requiring an encrypted wireless connection you can maintain the integrity of databeing transmitted to your wireless access point. The use of certificates or smart cardshelps to ensure the users identity, that your users are who they say they are.Also, setting a time-out that disconnects wireless user connections lasting longer than8 to 10 hours prevents your network from being attacked by a computer that isconnected through your wireless access point and left unattended.If you need to use WiFi, see “Network Access Control (802.1x)” on page 162 to leverage802.1x for securing WiFi traffic.Understanding RF Security ChallengesMany Mac laptop computers have a built-in wireless network card. Users can configuretheir computer to be a wireless access point to share their Internet connection withother users. However, a user creating this wireless access point doesn’t usually securelyconfigure it, creating a point of access for an attacker.Anyone within the wireless range can gain access to your network by using anauthorized user’s insecurely configured wireless LAN. These possible points of accesscan be very large, depending on the number of users with wireless technology on theircomputers.The challenge arises when trying to prevent users from creating this access point toyour network or trying identify where the access points are and who is attempting touse these insecure wireless access points.Many organizations restrict the use of wireless technology in their networkenvironment. However, many Mac laptop computers have wireless capability built-inand turning it off will probably not meet your organization’s wireless technologyrestrictions. You might need to remove components from Mac OS X to disable themfrom being mistakenly turned on in System Preferences.42 Chapter 3 Protecting System Hardware