User's Guide

Alarm Library
To view a list of Rogue Activity Alarms for each alarm sub-type, go to Configuration > Operational
Management > Alarm Configuration, open Rogue Activity, and then open the alarm sub-type to see all
the alarms associated with the sub-type.
Vulnerabilities Alarms
Vulnerabilities Alarms alert you to weaknesses that are not actively exploited, but have been detected in
the airspace. Weaknesses can potentially be exploited by both active and passive methods. For
example, unencrypted wired side trac leakage can be exploited passively by discovering wired-side
device information, while rogue APs can be actively exploited by a station associating to it.
Vulnerabilities provide an inherent security risk to the enterprise and should be carefully evaluated to
understand the potential exposure that could occur if a vulnerability was exploited. Once a vulnerability
is discovered options should be considered to remediate the vulnerability to prevent it from being
exploited. Vulnerability Alarms are broken down into the following five sub-types:
• Fuzzing - An active attacking technique that is used to find vulnerabilities and flaws in vendor's
wireless drivers. When a fuzzing attack occurs, a malicious user will generate valid 802.11 frames but
will randomly change information in the frames in an attempt to discover vulnerabilities in the
wireless driver. A successful fuzzing attack can have various outcomes, depending on the specifics
of the attack and the vulnerability in the wireless driver. Possible outcomes include full root access of
the attacked system, remote code execution, DoS attack, or kernel crash. In general, fuzzing attacks
present significant risk to the enterprise. Because wireless drivers receive and process broadcast
trac, fuzzing attacks may not require a physical connection but just physical proximity to the
attacker to execute a successfully attack.
• Predictive Problems - Through passive wireless monitoring AirDefense will provide events indicating
potential wireless security issues. Issues may be related to network or client configuration and may
not currently be actively exploited, however the danger exists that they could be exploited.
Predictive problem detection allows an administrator to take proactive measures to resolve security
issues before a malicious user has the potential to exploit it.
• Suspect Activity - Suspect Activity captures wireless events or activity, though not a direct attack on
the wireless network, suggest the potential for an exploit. Suspect activity events should be
reviewed as they generate, often suspect activity would be accompanied by an other exploit events
as it may be only one facet of malicious activity.
• Vulnerability Assessment - ADSP actively tests the security posture of the wireless infrastructure to
determine if there are weaknesses that could allow a wireless user to access sensitive systems on the
wired side. This is accomplished by allowing the user to perform scheduled or on-demand tests that
allow the sensor to emulate a station (laptop or other wireless device), associate to one or more APs,
and test dierent paths of access to the wired side. The alarms in this category indicate that a
vulnerability has been found in the security posture and should be considered a high priority event,
and could relate to the exposure of sensitive information such as cardholder information. This
vulnerability may be the result of a firewall or wireless switch misconfiguration, or some other
weakness in the layered defenses. A subsequent vulnerability report can be created based on these
alarms. In addition, the Action Manager can be used to automatically disable an AP until the
vulnerability has been remediated.
• Wired Leakage - In wireless networks unencrypted wired side trac leakage into the air is a result of
basic AP functionality. The AP at its most simplistic form is a bridge between the wired medium and
the wireless medium, allowing wireless devices to communicate with devices on the bounded wired
network. An AP typically works the same for trac in the reverse direction, trac from the wired
network can be transmitted into the air, to specific devices as well as broadcast addresses. The
Configuration
Tab Alarm Configuration
Extreme AirDefense User Guide for version 10.5. 629