Technology: Rogue AP Management

Rogue APs are one of the largest security threats to wireless networks.  They are also extremely difficult to detect and even harder to mitigate.

A Rogue AP is any access point that is installed on your wired network illegally.  Many times they are installed by network users not meaning to cause a security threat.  Example:  A network user wants wireless in their office and buys a consumer Access Point and hooks it up to the Ethernet jack in their office.  This is very hard to detect and provides a huge security hole for the entire office.  This also is a concern for many companies to meet PCI compliance or SOX compliance.

The Bandspeed AirMaestro solution has built-in Rogue AP detection and mitigation.  It is constantly scanning the environment for interfering Access Points that are plugged into the wired network.  Some competing solutions provide Rogue AP detection but only during initial boot-up or during a scheduled nightly scan.  The Bandspeed AirMaestro Access Points constantly scan providing real-time Rogue AP detection.  A nightly scan is less valuable as the Rogue AP may have left the office or may be powered off.  In addition, it will have been running as a security threat for hours before and after being detected.
The AirMaestro Access Points’ third radios (link) provide constant scanning as well as the ability to mitigate the threat caused by Rogue APs.  If a Rogue AP is detected on the network, the AirMaestro Access Points can deploy counter-measures using their third radio, all while not disrupting the wireless service provided to users connected to the AirMaestro Access Points.  These counter-measures render the Rogue AP and any device attempting to connect to it useless.

The WLAN Monitor Console and WLAN Management Console provide a network map that can aid the network admin in locating and physically removing the Rogue AP from the network*.  Non-AirMaestro Access Points can be authorized by the network administrator to participate in the network so they will not be detected or mitigated as a Rogue AP would.

In this screenshot, a Rogue AP has been detected near the Access Point closest to the conference room.

In this screenshot, the Rogue Device Manager shows all interfering APs as well as any APs detected as a Rogue AP.  The Rogue Device Manager is also used to authorize APs as Trusted APs.

* The AirMaestro Access Points do not provide an exact location of Rogues, but they do show the relative signal strength of the Rogue next to the AP that sees it strongest.  This significantly assists in locating the area of the WLAN network where the Rogue AP is present.