Nishant Verma-Independent Infosec Consultant
Are politicians jumping the gun when they make announcements that involve technical and legal complexities or they do their proper homework? SMART cities, free wifi, city surveillance - they ring jingles to ears, but what exactly they mean when it comes to implementation, perhaps politicians have little clue.
Its not just the great idea but need of the hour to have the convenience of WiFi to stay connected anywhere and everywhere. But just as the availability of WiFi services increase, so does the number of security risks and hackers on the prowl to hunt.
With little or no knowledge of best practices to use Internet the users are at risks, with little forensic capabilities the investigating agencies are handicapped and there are hardly any security compliances in India, so are we truly prepared for such projects?
The hackers can setup fake wifi zones/hotspots and steal the sensitive personal content. With free wifi available, most users will prefer to connect to the 'Free WiFi' access point, which may possibly connect them to a hacker's fake access hub.
Users who connect to these "free" networks are at huge risk of data loss and are susceptible to “Challenge attack”, which hackers use to capture usernames and passwords. Also there is little or perhaps no compliance requirements at the service provider level in case the user information is captured by the service provider, data leak can happen from there.
Further, if it becomes free for all with user identity not being captured, terrorists can exploit the city wifi.
Another risk is the launching of DDOS/DOS attack on the City Wifi network itself to bring the services down and make a political statement. Further not the least important concern is Inappropriate use of the wireless network, in particular access to obscene/Porn material or infringement of copyrighted works through Torrent or similar utilities peer to peer applications is a also a concern, and needs to be addressed, especially when the law is silent on many such issues.
Hence there is urgent need for the governments to understand the risks and cover them adequately to venture in this space. One must deploy both procedural and technical controls when architecting the City Wifi.
Â
Define an Acceptable/Restricted Use Policy for the Network Service
This policy sets of rules that define acceptable practices for use of the wireless network service and must clearly outline the consequences of violating the policy, this may require amendment to existing laws or creation of new law. This policy should be tied in with ISO 27001-security policy. The following are common elements in an acceptable use policy:
• Prohibited Uses
• Responsibilities of users
• Conditions for suspension or termination of the service
• Privacy
Technical controls:
Network security measures such as Content filters, firewalls, Web Antivirus solution, intrusion detection systems (IDS) / intrusion prevention systems (IPS), SIEM, Log management, NAC, rogue access point detection, and wireless IPS should be deployed to protect users from unauthorized network intrusion. Another consideration may be the need for a content filtering mechanism.
Registration portal should capture the details of the user like name, address, mobile number or possibly authentication against AADHAR number so that the identity of the user on the network is known and no anonymous user is allowed to access the services of the city wifi.
In addition, there has to be clearly defined incident response procedures. Despite everything the individual Internet user will continue to be the weakest link in the security chain hence there has to be education and awareness with tips for safe Internet surfing on continuous basis.
The state may also get into purchase agreements with the endpoint security providers like Anti Virus and Data Encryption companies and provide those security software for the end users against a fee or free of charge as the policy may be.
While it is encouraging to have the politicians moving forward and embracing technology but while if done rightly it can be a great step in building a SMART city but if done wrongly can be a big disaster and can not only impact the government and its credibility but can have huge impact on the users both financially and mentally.City WiFi-Challenges By Nishant Verma-Independent Infosec Consultant
Nishant Verma-Independent Infosec Consultant
Are politicians jumping the gun when they make announcements that involve technical and legal complexities or they do their proper homework? SMART cities, free wifi, city surveillance - they ring jingles to ears, but what exactly they mean when it comes to implementation, perhaps politicians have little clue.
Its not just the great idea but need of the hour to have the convenience of WiFi to stay connected anywhere and everywhere. But just as the availability of WiFi services increase, so does the number of security risks and hackers on the prowl to hunt.
With little or no knowledge of best practices to use Internet the users are at risks, with little forensic capabilities the investigating agencies are handicapped and there are hardly any security compliances in India, so are we truly prepared for such projects?
The hackers can setup fake wifi zones/hotspots and steal the sensitive personal content. With free wifi available, most users will prefer to connect to the 'Free WiFi' access point, which may possibly connect them to a hacker's fake access hub.
Users who connect to these "free" networks are at huge risk of data loss and are susceptible to “Challenge attack”, which hackers use to capture usernames and passwords. Also there is little or perhaps no compliance requirements at the service provider level in case the user information is captured by the service provider, data leak can happen from there.
Further, if it becomes free for all with user identity not being captured, terrorists can exploit the city wifi.
Another risk is the launching of DDOS/DOS attack on the City Wifi network itself to bring the services down and make a political statement. Further not the least important concern is Inappropriate use of the wireless network, in particular access to obscene/Porn material or infringement of copyrighted works through Torrent or similar utilities peer to peer applications is a also a concern, and needs to be addressed, especially when the law is silent on many such issues.
Hence there is urgent need for the governments to understand the risks and cover them adequately to venture in this space. One must deploy both procedural and technical controls when architecting the City Wifi.
Â
Define an Acceptable/Restricted Use Policy for the Network Service
This policy sets of rules that define acceptable practices for use of the wireless network service and must clearly outline the consequences of violating the policy, this may require amendment to existing laws or creation of new law. This policy should be tied in with ISO 27001-security policy. The following are common elements in an acceptable use policy:
• Prohibited Uses
• Responsibilities of users
• Conditions for suspension or termination of the service
• Privacy
Technical controls:
Network security measures such as Content filters, firewalls, Web Antivirus solution, intrusion detection systems (IDS) / intrusion prevention systems (IPS), SIEM, Log management, NAC, rogue access point detection, and wireless IPS should be deployed to protect users from unauthorized network intrusion. Another consideration may be the need for a content filtering mechanism.
Registration portal should capture the details of the user like name, address, mobile number or possibly authentication against AADHAR number so that the identity of the user on the network is known and no anonymous user is allowed to access the services of the city wifi.
In addition, there has to be clearly defined incident response procedures. Despite everything the individual Internet user will continue to be the weakest link in the security chain hence there has to be education and awareness with tips for safe Internet surfing on continuous basis.
The state may also get into purchase agreements with the endpoint security providers like Anti Virus and Data Encryption companies and provide those security software for the end users against a fee or free of charge as the policy may be.
While it is encouraging to have the politicians moving forward and embracing technology but while if done rightly it can be a great step in building a SMART city but if done wrongly can be a big disaster and can not only impact the government and its credibility but can have huge impact on the users both financially and mentally.
