Page 786 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Wireless Networks

Wireless networking is a popular method of connecting corporate and
home systems because of the ease of deployment and relatively low
cost. It has made networking more versatile than ever before.

Workstations and portable systems are no longer tied to a cable but
can roam freely within the signal range of the deployed wireless access
points. However, with this freedom come additional vulnerabilities.
Historically, wireless networking has been fairly insecure, mainly
because of a lack of knowledge by end users and organizations as well

as insecure default configurations set by device manufacturers.
Wireless networks are subject to the same vulnerabilities, threats, and
risks as any cabled network in addition to distance eavesdropping,
packet sniffing, and new forms of DoS and intrusion. Properly
managing wireless networking for reliable access as well as security
isn’t always an easy or straightforward proposition. This section
examines various wireless security issues.

Data emanation is the transmission of data across electromagnetic
signals. Almost all activities within a computer or across a network are
performed using some form of data emanation. However, this term is
often used to focus on emanations that are unwanted or on data that is
at risk due to the emanations.

Emanations occur whenever electrons move. Movement of electrons
creates a magnetic field. If you can read that magnetic field, you could

re-create it elsewhere in order to reproduce the electron stream. If the
original electron stream was used to communicate data, then the re-
created electron stream is also a re-creation of the original data. This
form of electronic eavesdropping sounds like science fiction, but it is
scientific fact. The United States (U.S.) government has been
researching emanation security since the 1950s under the TEMPEST
project.

Protecting against eavesdropping and data theft requires a
multipronged effort. First, you must maintain physical access control
over all electronic equipment. Second, where physical access or
proximity is still possible for unauthorized personnel, you must use