User's Manual

APPENDIXD
SECURITY
Revised: 27 Jun 16 APX D-2 ESTeem Horizon Series
128‐BITWEP

The128WEPusesaparticularalgorithm calledRC4encryptiontoencodeanddecodetrafficthatisbasedona104‐bitencryption
keyanda24‐bitInitializationVector(IV).RC4startswitharelativelyshortencryptionkey(104bits)thatisexpandedintoanearly
infinitestreamofkeysto accompanythest
reamofpackets.

ThebasicconceptofRC4isgood,butthewayit’simplementedinWEPleavesitopentocompromise.Theresearchersthattest
theintegrityofthesystemusuallyfocusononepieceoftheimplementation,theInitializationVector(IV).

TheIV(24bits)isthealgorith
mcomponentthat’ssupposedtokeepexpandedkeysfromrepeating.Fromtheresearcher’spoint
ofview,ahigh‐volumeaccesspointismathematicallyguaranteedtoreusethesamekeystreamatleastonceaday.Whenthis
happens,it’scalledanIVcoll is ionthisbecomesasoftspottoenterthesyst
em.

Theresearchersaren’tsayingthatit’seasytobreakintothesystem,orthatit’sbeingdoneonaregularbasis,onlythatitispossible
andadministratorsshouldconsiderwaystoreducethepossibility

AccessControlList(ACL)

TheACLisoneofthesimplestyetmostsecuremethodsofnetworksecurity.TheACLisaconfigurableMACfilterintheModel
192EthatcanbesettoallowspecificMACaddressonthewirelessnetworkbyindividualaddressoraddressranges.Thesame
filtercanal so besettorej
ectindividualMAC addressesoraddressranges.

TheMACaddressisaunique,6hexadecimalfieldaddressassignedatthemanufacturerthatcannotbechanged.TheMACaddress
istraceablethroughtheIEEEgoverningbodytothemanufacturerandisthe“fingerprint”for allEthernetdevices.

Using acomb
ination ofboth theWPA or 128‐BitWEP encryptionand the ACLfilter provide theESTeem an extr emelysecure
wirelessnetworkinglayer.

DisablingBroadcastProbesandHidingSSID

Asimplebutveryeffectivewayofsecuringanetworkistomakethenetworkdifficulttofind.Bydisablingbroadcastprobesand
hidingtheServiceSetIdentification(SSID),wirelessandnetwork“sniffers”willnotbeabletofindyourESTeemHorizonnetwork.
Togainaccessto thewirelessnetwork,youwouldberequi
redtohavetheSSIDandallsecurityloadedintheWLANcardsoftware
priortoenteringthenetwork.

ProprietaryBridgeCommunication

Althoughthe ESTeem Horizon is compatible withthe open communicationstandards IEEE802.11g and802.11b, therepeater
communicationbetweentheunitsisaproprietarycommunicationlink.Noothermanufacturerofwirelesshardwarecanaccess
theESTeemrepeaternetworkwhenbridgingbetweenEthernetnetworks.Thisproprietarycommunicationlayer,incombination
withtheothe
rsecuritysettings,allowsyou astheusertoreject wirelessclientsintothenetwork ifso desired.Whenusedin
conjunctionwiththeAccessControlListthe802.11gand802.11bclientaccesscanberemoved.

The security level of the bridge communication link is configurable for 64‐Bit WEP, 12
8‐Bit WEP or TKIP and is completely
independentoftheclientaccessleveloranyothercommunicationlinklevel.Forexample,anESTeemHorizoncanbeconfigured
forWPAEnterpriseforclientlevelaccess,communicatetoanotherESTeemHorizonusingaTKIPbridgelinkandalsocommunicate
128‐BitWEP toourold
erESTeemModel192Eradiomodemsallrunningsimultaneously.
