How risky is a personal-use-only wireless subnet inside the corporate subnet?

Question

My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data plan, and in special circumstances, employees can use a company-provided wireless hotspot. Unfortunately, many of the employees get bad reception in the office, but we still make them use their data plan when we could be connecting over WiFi.

I'm trying to do a risk assessment of an arrangement like this, where the secured devices are given access to the LAN, and the unsecured devices are given access only to the internet via an additional router, a wireless one.

{internet} <-> [router] <-> [secured devices]

{internet} <-> [router] <-> [wireless router] <-> [unsecured devices]

My thought is that since the unsecured devices will be on their own subnet, they wouldn't pose a significant threat to the secured devices. This subnet would be for personal use only, and I'm thinking the unsecured devices would not be able to access the secured devices outside their subnet. I'm mostly speculating though, since I haven't been able to find a lot of resources on the subject. This answer points to some BYOD resources, but not a separate personal-use-only network.

I'm guessing a better option is to replace the {internet} <-> [router] with {internet} <-> [switch] to which both independent routers are connected. However, this option is a lot less feasible, so I really only want to make that kind of recommendation if the other option is too risky.

Answer 1

Merely putting personal-use internet on a different subnet is normally not sufficient unless that subnet is firewalled from the rest of the company; there are all kinds of internet vulnerabilities that hijack a users' PC and pose a threat to your company unless you are smart about protecting yourself. This is one example of a innocent-looking Wordpress compromise (CVE-2013-1949) that would be a threat to an unprotected internal network.

Personal-use Internet for BYOD is not a security risk if done correctly...

• All personal-use wifi access should be performed with 802.1x (usually PEAP) so you can revoke wifi access credentials on a per-user basis.

  • Avoid shared credentials like WEP or WPA PSK (i.e. you're not giving internet access to the general public, so there is no need to use well-known wifi credentials)
  • Use wIPS to keep an eye out for rogue APs which spoof your SSID because PEAP clients are vulnerable to AP impersonation attacks under some circumstances
  • Disable client to client traffic (Cisco calls it "peer to peer traffic") to avoid problems with clients attacking other clients over your wifi (ARP spoofing attacks are just one example)
• Your company is still responsible for the behavior of these users if they abuse your internet connection
  • Build a good security policy for acceptable-use of the personal-use internet connection; require users to sign and accept the policy before connecting (your corporate HR / legal departments may want to be involved here as well).
  • Proxy and log all internet access from this subnet
  • Use an IDS / IPS if-possible for the personal-use Internet DMZ
• If the personal-use wifi AP is in autonomous mode, some possible network design options to isolate personal-use internet traffic from your corporate network:
  • The vlan for the wifi AP could be in an internet-only VRF
  • The vlan for the wifi AP could be directly attached to your internet FW (in a DMZ)
• If the personal-use wifi AP is managed from a Wireless LAN Controller, some possible network design options to isolate personal-use internet traffic from your corporate network:
  • The WLC could direct all personal-use internet traffic to an internet-only VRF
  • The WLC could have a VLAN that is attached to your internet FW (in a DMZ)

Answer 2

The simple answer is yes, you can do this and keep the secure network entirely protected from the unsecured network. However, the devil is in the details and there are a number of details missing to provide any real answer.

Specifically, you mention a router and a wireless router, but not the types or the capabilities. If you are talking about consumer class devices, then no you probably can't do what you want. To the router, the wireless router and the clients behind it will all appear as one more client on the secure network.

If you are talking about enterprise class equipment, then this would be relatively easy. This would allow the use of VLANs, ACLs and/or routing as tools to create the separation you want.

SOHO class devices can fall into either of the two above solutions.

Answer 3

it is almost impossible to write a good answer on this question as there are so many things that would need to be taken into consideration.

In short: If the security device which is securing internal users is configured properly and is blocking all unwanted communication (for example communication from from the Wifi network to the internal network) you should be ok when it comes to securing the internal devices.

You would need to find answers for the following problems though: - How to prevent wireless users from using up all bandwith on the internet access which could prevent internal users from working? - How to identify wifi users? You don´t want an hotspot were a user could access illegal stuff anonymously. How do you log and track the connections from Wifi?

Answer 4

It depends. I would view the issue in two aspects. - risk of wireless being compromised - what access the wireless network has if it is compromised or a compromised host runs on it.

The former aspect has already been talked about extensively, so I haven't a lot to add, other than if it is a guest network then a lot of the more secure options e.g. dot1x is out of the question. If you are paranoid you could use a guest controller that offers one time passwords e.g. via a ticket printer (hotels etc. use these).

The latter aspect is relatively straightforwards from a design POV: just make sure whatever VLAN or network segment it goes on has no access to your corporate network whatsoever. All of below would work, in decreasing order of security - Completely separate network including physically separate equipment/internet links - Virtually separate network via VRF that only has internet egress (combine with firewall or not) - Firewalled or ACLed VLAN that only has permission to egress to internet (but runs in same VRF or routing context as normal) - this is the easiest solution and is probably good enough unless you are military/banking etc.