Wireless networks extend the range of traditional wired networks by using radio waves to transmit data to wireless-enabled devices such as laptops and personal digital assistants. Wireless networks are generally composed of two basic elements: access points and other wireless-enabled devices, such as laptops. Both of these elements rely on radio transmitters and receivers to communicate or “connect” with each other. Access points are physically wired to a conventional network, and they broadcast signals with which a wireless device can connect. The signal broadcast by the access point at regular intervals—several times per second—includes the service set identifier, as well as other information. Typically, this identifier is the name of the network. Wireless devices within range of the signal automatically receive the service set identifier, associate themselves with the wireless network, and request access to the local wired network. Wireless networks are characterized by one of two basic topologies, referred to as infrastructure mode and ad hoc mode. Infrastructure mode—By deploying multiple access points that broadcast overlapping signals, organizations can achieve broad wireless network coverage. Commonly used on campuses or in office buildings, infrastructure mode enables a laptop or other mobile device to be moved about freely while maintaining access to the resources of the wired network (see fig. 1). Ad hoc mode—This type of wireless topology allows wireless devices that are near one another to easily interconnect. In ad hoc mode laptops, desktops, and other wireless-enabled devices can share network functionality without the use of an access point or a wired network connection (see fig. 2). The increased speed of wireless networks has helped to fuel their growth and popularity. The growing popularity of wireless networks can be easily witnessed in urban environments. For example, during a recent test in Washington, D.C., we drove around 15 square blocks and, using a commonly available wireless network scanner, we detected over a thousand wireless networks. Figure 3 depicts a sample of the saturation of wireless networks we detected during our brief test. Wireless networks offer connectivity without the physical restrictions associated with building wired networks. Though generally developed as an extension to an existing wired infrastructure, a wireless network may be stand-alone as well. The key reason for the growth in the use of wireless networks is the increased bandwidth made possible by the 802.11 standard and its successors. The implementation of the 802.11 family of standards increased the data transfer rates offered by wireless networks, making them comparable to those available in the wired environment. The 802.11 standard was first approved by the Institute of Electrical and Electronics Engineers (IEEE) in 1997. IEEE’s goal was to develop and establish a technology standard that insured global interoperability among wireless products, regardless of their manufacturers. This initial wireless standard was useful for certain applications, but the data transfer rate it specified was far slower than that of wired networks. Responding to the data transfer rate limitations set by the initial standard, the IEEE released several additional standards with the intent of increasing the transfer rates and making wireless functionality comparable to that of wired networks. The significant increases in data transfer rates of the new standards, coupled with the availability of affordable wireless-enabled devices, contributed to the rapid adoption of wireless networks. The Federal Information Security Management Act (FISMA) requires each agency to develop, document, and implement an agencywide information security program to provide security for the data and information systems that support the agency’s operations and assets. FISMA gives OMB many responsibilities for overseeing the agency information security policies, including developing and overseeing the implementation of policies and standards for information security; requiring agencies to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, modification, or destruction of federal information and information systems; and coordinating the development of standards and guidance. OMB annually reports to Congress on the progress of agencies’ compliance with FISMA. Accordingly, agencies need to evaluate the risks and develop policies for emerging technologies such as wireless networks. The National Institute of Standards and Technology (NIST) develops standards that agencies are required to follow and guidelines recommending steps that agencies can take to protect their information and information systems. In November 2002, NIST released Wireless Network Security: 802.11, Bluetooth and Handheld Devices (Special Publication 800-48), which is intended to provide agencies with guidance for establishing secure wireless networks. The guidance recognizes that maintaining a secure wireless network is a continuous process requiring additional effort beyond that required to maintain other networks and systems. Accordingly, NIST has recommended that federal agencies perform risk assessments and develop security policies before purchasing wireless technologies and anticipate that their unique security requirements will determine which products should be considered for purchase; wait to deploy wireless networks for essential operations until after agencies have fully assessed the risks to their information and system operations and have determined that they can manage and mitigate those risks; assess risks, test and evaluate security controls more frequently than they would on a wired network. Currently, NIST is in the process of developing a follow-up to this publication, which will reflect the recent updates to the 802.11 network standards. Wireless networks offer federal agencies two primary benefits: increased flexibility and easier installation. Because wireless networks rely on radio transmissions, federal employees can work in a variety of ways. For example, users can take laptops to meetings, create ad hoc networks, and collaboratively develop products or work on projects. In addition, if a federal agency has installed a wireless infrastructure, users with wireless- enabled devices can work throughout the agency’s facilities without having to be in a particular office. Finally, an agency employee traveling with a wireless-enabled device may be able to connect to an agency network via any one of the many public Internet access points or hotspots found in hotels or in commercial, retail, or transportation centers. This ability to connect to the agency’s systems via wireless networks can increase employee productivity. Ease of installation is commonly cited as a key attribute of wireless networks. Generally, deployments of wireless networks do not require the complicated undertakings that are associated with wired networks. For example, the ability to “connect” the network without having to add or pull wires through walls or ceilings or modify the physical network infrastructure can greatly expedite the installation process. As a result, a wireless network can offer a cost-effective alternative to a wired network. In addition to their increased ease of installation, wireless networks can be easily scaled from small peer-to-peer networks to very large enterprise networks that enable roaming over a broad area. For example, an agency can greatly expand the size of its wireless network and the number of users it can serve by increasing the number of access points. Wireless networks face all of the information security risks that are associated with conventional wired networks, such as worms and viruses, malicious attacks, and software vulnerabilities, but there are significant challenges that are unique to the wireless network environment. In implementing wireless networks, federal agencies face three overarching challenges to maintaining the confidentiality, integrity, and availability of their information: protecting against attacks that exploit wireless transmissions, establishing physical control of wireless-enabled devices, and preventing unauthorized wireless deployments. Protecting against wireless network security attacks is challenging because information is broadcast over radio waves and can be accessed more easily by attackers than can data in a conventional wired network. For example, wireless communications that are not appropriately secured are vulnerable to eavesdropping and other attacks. Poorly controlled wireless networks can allow sensitive data, passwords, and other information about an organization’s operations to be easily read by unauthorized users. In addition, wireless networks can experience attacks from unauthorized parties that attempt to modify information or transmissions. Table 1 provides examples of the different types of attacks that can threaten wireless networks and the information that they are transmitting. Physical control of wireless-enabled devices takes on new importance in maintaining information security. Areas of physical risk include the placement and configuration of wireless access points and control of the wireless-enabled device that connects to the agency’s network. For example, it can be difficult to control the distance of wireless network transmissions, because wireless access points can broadcast signals from 150 feet to as far as 1,500 feet, depending on how they are configured. As a result, wireless access points can and do broadcast signals outside building perimeters. Figure 4 illustrates how poorly positioned or improperly configured wireless access points may radiate signals beyond the physical boundaries of the agency’s facility or the range within which the agency desires to send its signal. Wireless signals broadcast from within an agency’s facility that extend through physical walls, windows, and beyond a building’s perimeter—commonly known as “signal leakage”—can increase an agency’s susceptibility to the various attacks described in table 1 above. In addition to the challenge of signal leakage, it can be difficult for wireless network administrators to track the physical location of wireless-enabled devices. For example, in conventional wired networks, users are required to physically plug in to the agency’s networks via cable. This allows administrators to determine where each device is connected. However, with a wireless network, pinpointing a wireless-enabled device’s location can be difficult because the device is mobile. As a result, it can be harder for information security officials to locate unauthorized devices and eliminate the risks they pose. Unauthorized wireless networks create two main challenges for agencies’ information security. The first challenge comes from legitimate agency organizations, employees, or contractors seeking to benefit from the flexibility of wireless networks. Because of the affordability and availability of wireless network equipment, well-meaning individuals might install unauthorized wireless-enabled devices or wireless access points into an agency’s traditional wired network environment without the approval of the agency’s chief information officer. As a result, agency information security officials might be unaware that wireless networks are being used and would therefore be unable to take the appropriate mitigating actions— such as protecting against potential wireless attacks or preventing signal leakage. The second challenge stems from the increasing availability and integration of wireless technology into products such as laptops.