A few days ago I read an article regarding security and compliance in retail. As we are well aware a retail space can consist of both guest and enterprise environments. Of course, the article rightfully focused on the protection of enterprise systems (i.e. POS, back office, inventory, etc.) within an enterprise environment. The strategies presented were accurate and consisted of such topics as detection throughout a transactional process, multi-level protection, and security education. As a wireless and (aspiring) security professional I immediately realized that, although accurate, the strategies presented did not account for a wireless environment. More specifically, the article did not account for the installation and verification (or sign-off) of an enterprise wireless environment. Before applying any post-deployment strategies a network architect must ensure that the environment is, at the very least, initially pristine.
Many retail organizations handle the wireless deployment (installation, configuration, verification) in-house. For organizations that adopt that model, hiding the SSID, changing the passphrase to the SSID after every deployment, MAC authentication, and the proper ACLs may be enough. But what if the retail organization is a nationwide enterprise with 500+ locations and has employed the services of an MSP? One can still hide the SSID, but now the SSID and passphrase are known by someone outside of the retail organization – namely, the installer. In fact, the “hidden” SSID and passphrase can be potentially known by 500+ WLAN installers (non-employees). In such an environment, changing the passphrase and/or SSID after every deployment is no longer scalable.
Part of ensuring that the environment is pristine consists of ensuring that only those that require network credentials to the enterprise environment actually have the credentials to the environment. Without a viable, comprehensive solution to this potential catastrophe, not only is the network in danger, but so are the installers. If there is a security breach during the deployment of this large nationwide network, the integrity of the installers, along with anyone else that has knowledge of the network SSID and its credentials, comes into question. So my questions to the community are the following:
- How do we better protect the networks?
- How do we better protect the installers?