The KRACK Wi-Fi vulnerability issue of October, 2017 reminded us all, once again, that security should be top of mind for anyone responsible for device security and network communications. KRACK (Key Reinstallation Attack) involved an issue with the WPA2 protocol, which encrypts Wi-Fi traffic for a huge majority of devices and routers today. In other words, this issue impacted almost everyone with a computer.
What can we learn from this?
Wikimedia Commons
Lesson 1: Security flaws are no surprise
Unfortunately, these issues are expected, as they are a predictable reality in the world of wireless communications. But there is a silver lining. This knowledge empowers us to establish and follow best practices. The key lesson here is not a news flash that security is critical. It is simply a reminder: under no circumstances should you rely on any one security method to protect your network from attacks.
A typical network follows the OSI 7-layer communication model*, and each of these layers can employ security measures. The layers include:
- Physical layer: The functions at the hardware level. The primary purpose of this layer is to define physical signals responsible for transmission through the medium that supports the communication.
- Data link layer: The layer responsible for defining the protocol for direct node-to-node bit-level data transfers. The protocols can include the 802.11 wireless protocols between the station and the access point. Communication types, such as Wi-Fi or Ethernet, can vary in this layer. The KRACK vulnerability occurred at this layer.
- Network layer: The layer responsible for handling data in a multi-node network and managing communications between hosts that employ various protocols. An example protocol is Internet Protocol (IP) version 4.
- Transport layer: The layer that handles flow control of data. This is typically seen as the TCP layer.
- Session layer: The layer that handles communication sessions and authentication via common application protocols.
- Presentation layer: The layer that converts incoming and outgoing data into another presentation format, and can decrypt encrypted data. This layer is typically where the SSL/TLS encryption streams occur.
- Application layer: The layer that handles formatted application data input and output with applications such as email clients and web browsers.
*Note that we’ve take some liberty with the definition of the TCP/IP protocols and the OSI 7-layer model. TCP/IP does not fit nicely into the OSI model. However, we find that using the OSI model is critical in reviewing security in networking and applications.
Lesson 2: Employ the “security in depth” best practice
In a truly secure application, security occurs at multiple layers, and minimally at the data link, transport and presentation layers. Your application’s security strategy must not rely on any one layer. Each of the layers in this model can and will fail, sometimes spectacularly.
Therefore, a best practice is to monitor and implement industry standard security methods in as many of your networking layers as possible. When a security vulnerability or attack targets one of the layers, you will then have other robust measures in place. These measures are your “get out of jail free” card when one layer is compromised.
Let’s look at Wi-Fi and the KRACK vulnerabilities as an example. With Wi-Fi, your data is transmitted from your device to the access point, and no one can read or decode it. By contrast, if everyone is connected with a network hub you can effectively see each other’s traffic. The KRACK vulnerability, which affected all systems that implemented the WPA/WPA2 standard, allowed everyone to effectively see your traffic in the same manner, as if they were on the same wired network. With Wi-Fi (at the Transport layer), you can’t control a rogue station listening to the Wi-Fi radio signal. For this reason, you must have security protocols such as the WPA/WPA2 standard to encrypt the traffic. Further, if you also have the most up-to-date TLS session-level protocols, you are protected even in the event of a Wi-Fi vulnerability.
Lesson 3: The lifetime of every security measure is limited
Security methods do expire. Since security vulnerabilities can and do occur on a frequent basis (typically measured in months, not years), the standards for protecting our networks and data must be updated regularly. The networking industry has been repeatedly hit with headline makers, such as the POODLE issue that compromised SSL and TLS 1.0, as well as many other attacks on authentication, certification and verification methods across multiple layers and communication methods.
As the security protocols and standards change, it is up to enterprises and their network managers to employ those updates to protect their systems and networks.
Lesson 4: Work with product vendors who are committed to security
Because security requires a multi-pronged approach, not only is it important to ensure that your networking policy is robust, but also that the products you incorporate into your systems are engineered for security.
Meet Digi TrustFence™
- Develop products that incorporate features to mitigate the most common security vulnerabilities and attacks against devices.
- Commit to keeping up to date on security lifecycle continuous improvement.
Choosing products built on this model enables you to easily integrate device security, device identity, and data privacy capabilities into your systems and designs.
In summary
While being “bullet proof” may not be a realistic goal, it is critical to create a robust strategy that helps you prepare for and respond to security issues, before they occur and when they occur. This includes maintaining updated standards across multiple networking layers, and incorporating products that are engineered to adapt to security threats as they evolve.