wirelesswall secure – versatile -proven ed smith – ceo wirelesswall, llc [email protected]...

WirelessWallSecure – Versatile -Proven

Ed Smith – CEOWirelessWall, [email protected]

2012 HPIC Meeting – Los Alamos NM - September 26, 2012

WirelessWall - A Mature, Proven solution

• The WirelessWall Core Technology was originally developed by U.S. Navy to provide secure, Mobile shipboard networks, it is a “Secure in Place” solution

• Mature and fielded since 2001 (DoD, DOE, Municipal and Commercial entities) the design has met the needs of multiple federal and military agencies

• Over $50M investment for development, prestigious BOD Military and Civilian advisors

• Multiple NIST certifications and FIPS 140-2

• Premiere Vendor support: Cisco, Motorola, Aruba, Nortel, etc.

• JSIC/JFCOM multi-year tested 2005-2009 recommended for interoperability DoD-wide and use by Coalition Forces

Copyright WirelessWall LLC 2012

WirelessWall Layer 2 Advantage

• Wireless mesh network infrastructure once in place, need to be secured. It was for this demanding environment that the WirelessWall platform was built, to secure in place, all networks of all kinds.

• The WirelessWall security was built as a vendor agnostic platform offering end to end

security. The platform offers simplicity in offering Layer 2 security through by installing software in on device then the other. Under this solution everything in between, over the wireless, as well as the wired portion of a network, is secured.

• A common management interface can handle clusters of access points even in

mobile mesh for zoned security. The bottom line is that existing communication infrastructure combined with wireless 802.11x, mesh and WiMax technologies now have a platform of offering end to end security in shared public/private networks.


WirelessWall- the industry’s first Wireless Firewall

● Like a firewall, it supports policy filters to control what services users can access on a network and provide an audit trail.

● Like a VPN, it provides encrypted network access for users via a client

● Superior to a firewall or a VPN because it is Layer-2, with considerable performance and simplicity advantages over IPsec or SSL

● FIPS 140-2 certified strong AES encryption with Control comparable to WPA2-Enterprise, even on legacy WiFi

● Offers best-of-breed wireless security: strong encryption, authentication and access and protects data in-transit for WiFi, WiMax, Mesh, 3G, 4G, Zigbee or LANs ● Makes the wired and wireless portions of a network “unsniffable,” and improves any network topology by adding blanket end-to-end encryption


Encryption is the future

• Killing Data:“In The Future, Encryption Will Become The Cornerstone Of Your Data Security And Privacy Strategy” – Forrester , January 30, 2012

• “Most security professionals today do not understand the motivations behind data theft; they put controls in place that protect the data that is most valuable to them, as opposed to the data that is most valuable to criminals.”

• In the future, you will encrypt data — both in motion and at rest — by default. This data-centric approach to security is a much more effective way to keep up with determined cybercriminals.

• “Ubiquitous encryption is the only hope we have of maintaining some kind of parity with attackers in the new threat landscape.”


http://docs.media.bitpipe.com/io_10x/io_103619/item_503688/killing_data1.pdf





Accomplishments – SRNS Team and Canberra Support

• Don Gregory - pioneered the development and implementation of the RF Networking in Limited and Protected Areas at SRS DOE facilities. (Started project in 2003)

• Pervis Rouse – Joined the team in 2005 to assist in further development/implementation.

• Scott Rogers – Canberra has provided and continues to provide primary technical support to the effort.

• Dennis Hadlock supported the entire effort in his organization and made the implementation possible.

• Tim Martinson has been involved with the effort over a number of years.


Cost/Benefit Analysis

• The actual benefits seen at SRNS include:– Dramatically reduced installation costs– Providing a solution when wired networks are not an option– Overall improved data security– Reduced manpower needs– Dramatic overall cost savings compared to wired networks – The cost of pulling cables can run into the hundreds of dollars per foot– Cost of the documentation and planning, union labor, any penetrations into

sealed areas– Assuming a nominal $100 per foot to pull cable and a small building with 300-

400 feet of cable as an example, for a total in just cable cost of $30k to $40k – WirelessWall would be roughly 20% of the wired costs


Summation

• WirelessWall is approved by DOE and has been in use at SRNS for 6 years

• It is a software “Secure in Place” solution that allows existing equipment to be protected without replacement

• Wireless/Wired “Solid Core Security” can be implemented very quickly and cost-effectively

• The major advantages WirelessWall are cost and ease of implementation

• Secure encryption is mandatory in today’s threat environment


Background

The Savannah River Site, a 310 square mile site, is located in the south eastern coastal area of the United States in the state of South Carolina. It is bordered to the west by the Savannah River and Georgia, and is close to several major cities, including Augusta and Savannah.(GA.), Columbia, Greenville, and Charleston (S.C.). It is in an area residents refer to as the Central Savannah River Area, or CSRA.

Site Facts

• The site was built during the 1950s to refine nuclear materials for deployment in nuclear weapons. It covers 310 square miles (800 km2) and employs more than 10,000 people.

• It is owned by the U.S. Department of Energy (DOE). The management and operating contract is held by Savannah River Nuclear Solutions LLC (SRNS)(Savannah River Nuclear Solutions (SRNS), LLC - now a Fluor partnership with Honeywell, and Huntington Ingalls Industries (formerly part of Northrop Grumman)), and the Liquid Waste Operations contract is held by Savannah River Remediation, which is a team of companies led by URS Corporation.

Reactor name Start-up date Shutdown date

R Reactor December 1953 June 1964

P Reactor February 1954 August 1988

K Reactor October 1954 July 1992

L Reactor July 1954 June 1988

C Reactor March 1955 June 1985

Current and Future Missions

• Home to the Savannah River National Laboratory.• Contains the nation's only operating radiochemical separations facility.• Tritium facilities are also the United States' only source of tritium, an essential component in

nuclear weapons.• The nation's only mixed oxide fuel (MOX) manufacturing plant is being constructed at SRS.

When operational, the MOX facility will convert legacy weapons-grade plutonium into fuel suitable for commercial power reactors. On August 1, 2007, construction officially began on the $4.86 billion MOX facility. The current deadline for the completion of construction is 2014. Following startup testing, the facility would begin operations in 2016 with a disposition rate of up to 3.5 tons of plutonium oxide each year. The mission is supposed to end in 2035, although it could be extended to 2038.

• Major focus is cleanup activities related to work done in the past for the nation's nuclear buildup.

• Currently none of the reactors on-site are operating, although two of the reactor buildings are being used to consolidate and store nuclear materials.

• Future plans for the site cover a wide range of options, including host to research reactors, a reactor park for power generation, and other possible uses.

ALARA: Why Use RF Networking?

Initial cost avoidance of hard-wired networked system installations.

• Much less expensive than the installation of hard-wired systems. This is particularly true for older existing radiological facilities.

• For D&D (Decommissioning and Demolition) Facilities, Wireless Systems can be removed before building demolition and be re-used.

Reduced man-hours and materials associated with source checks and alarm responses for ARMs and CAMs.

• Source Checks on ARMs can be preformed remotely; Alarms can be acknowledged and the status of the entire network checked remotely prior to leaving the RCO office.


Reduced worker radiation and contamination exposure.

Following an alarm RCO can perform initial investigation without entering an unknown radiation or airborne contamination condition. Routine operational checks and source checks on ARMs can be performed without entering a radiation area. Routine operational checks and alpha spectrum can be viewed on Alpha CAMs before entering the contamination area.


Improved Facility operational control.

For ARMs and CAMs the alarm and operational status of the network can be checked at the operational center or any access point. The Control Room and the RCO office can get alarms and have full access to the information at the same time and avoid notification errors.


Improved alarm and operability communications.

The status and operability of the monitoring equipment can be checked real-time. Changes in radiological condition on special jobs or operations can be monitored closely.


Flexibility in the deployment of equipment.

Relocation of portable and fixed monitoring equipment can be completed quickly reducing exposure to radiation and contamination.

Operational data electronically archived and will enhance reconstruction of events and job planning. Operational data is date/time stamped and electronically saved daily. In the event of an incident the operational data on all of the associated equipment can be reviewed. Previous events/jobs can be critiqued to reduce exposure and time in the area.

Component List

• ASUS VMWare Complete Workstation – Windows Office Suite and Canberra/Aquila RadHawk Program.

• Canberra Alpha Sentry Manager ASM1000, Canberra Alpha Sentry Continuous Air Monitor Sampling Head, Thermo RMS3

• D-Link 4-Port Ethernet Switch• Wireless Wall – FIPS 140-2 Validated• Cranite’s FIPS 140-2 Compliance Certificate• Proxim ORiNOCO Mosel Ap-4000 Access Point• ORiNOCO Model Classic Gold, PC Card• Aquila, RadComm/Code Talker RF Interface

RF Systems

CANBERRA AQUILA/Wireless Wall • Applicable for most RME (ARMs, CAMs, ICAMs & PCMs)• FIPS (Federal Information Processing Standard) 140-2 Compliant

- for use in all Areas (including Limited and Protected Areas).• Can support multiple access points• Network is easily expanded (at a later date as equipment is

added)• Fixed or Portable Application • First and Only DOE facility to install and operate wireless

networking of radiation equipment in Limited and Protected Areas and approved by DOE.

WIRELESSWALL

• provides government certified security software for WLANs • WirelessWall carries a FIPS 140-2 rating. FIPS is short for

Federal Information Processing Standards; the 140 cryptographic standard was created by the National Institute of Standards and Technology (NIST). The standard has four levels of security - Level 1, Level 2, Level 3, and Level 4 -- that increase in quality as they go up. FIPS 140-1, the first level, only supports DES and 3DES encryption. The various levels are suitable for a wide array of areas in which cryptographic modules could be used.

• WirelessWall generally comes with three pieces: the policy server, an access controller for each subnet of the network, and client software for each PC.

RADHAWK CLIENT - Features

• Windows Based Application• RadNet Compliant • RadNet - is a non-proprietary protocol that utilizes standard Internet

protocols• Remote monitoring of up to 256 instruments• User-definable colors, sounds, backgrounds and tab hierarchy• Timeout alarm• Multiple password levels• Data logging• Spectrum panning• Windows® 2000 and XP• Accessible via wired or wireless Ethernet LAN• Able to accommodate non-RadNet compliant devices via Code Talker

hardware

RadNet Packet Types Currently Supported

• Alpha CAM• Beta CAM• Gamma Area Monitor• Gamma Criticality Monitor• Neutron Area Monitor• Neutron Criticality Monitor

RF Systems in Service

RMS3 ARMs 105-L (Protected Area) Basin Alpha CAMs in 105-K (Protected Area) ARM and CAM demo System 735-2B F-Canyon TRU Waste Remediation Project CAMs

Pending RF Deployment

Alpha CAMs and ARMs in H-Canyon awaiting facility design change. (Limited Area) Testing is complete and design change approved.

HB-Line awaiting facility approval for testing (Limited Area). RMS3 Risk Assessment/Installation is in progress at H-Tank

Farm. F-Tank Farm is awaiting facility approval for Risk Assessment

testing.

K-Area – Nuclear Material Management

Appended Technical Equipment Detail

Portable Alpha CAM – Original Design

RF Transmitter

CAM HeadASM1000

Omni Antenna

Front View - New Portable ASM1000/AS1700R Unit

CAM Head

Omni Antenna

RF TransmitterASM1000

Side View

CAM HeadOmni Antenna

ASM1000RF Transmitter

Additional Views

Canberra/Aquila Code Talker RF Transmitter

Mounting Bracket & Clips

Gasket Seal NEMA 4 Enclosure

FIPS Encryption

RF Card

Computer, RMS3 RS232, or CAM RS485 Cable

Antenna Cable

AC Power Adapter

Dimensions

9.6” x 6.6” x 2.6”

Proxim Orinoco AP-4000 Access Point - Repeater

In computer networking, a wireless access point (WAP) is a device that allows wireless devices to connect to a wired network using Wi-Fi, Bluetooth or related standards. The WAP usually connects to a router (via a wired network), and can relay data between the wireless devices (such as computers or printers) and wired devices on the network.

Diagram of Portable RF RMS3

The RMS-3 is an area and criticality radiation monitoring system

designed to provide early warning if a hazardous condition develops.

HTF Portable RMS3 ARM

Omni Antenna

Detector

RF Transmitter

RMS3

Directional Antenna

First portable VAMP Cart Conversion without RF capability

VAMP - Victoreen Area Monitor Packet

Old VAMP Cart to be converted to RMS3

30”w x 30”h x 9”d 20”w x 16”h x 9.5”d

TYPICAL AQUILA/WIRELESS WALL RF NETWORK

Examples of HTF West Hill RF RADHAWK – Screen Shots

Examples of HTF East Hill

Radhawk Display

45

WirelessWall Value PropositionsThe recognized value propositions of WirelessWall are:

• Eliminates major cost of secure wireless provisioning. By encrypting at the end-points, no security is required for APs and no need to use exotic vendor specific schemes for AP management.

• Cloaking. Fills security gaps by providing uniform high (WPA2-Enterprise) security-only across at layer 2, eliminating port and application vulnerabilities and securing heterogeneous networks.

• Low Overhead. High end encryption requiring low overhead and low bandwidth.• Multiple AP encryption. End to end pass-through of already-encrypted frames • Fast . No intermediate encryption required for multiple AP's. • Improves security. Eliminates Man-in-the-Middle (MITM) spoofing/sniffing risks or Denial of Service

(DoS) vulnerabilities of IPSec and SSL VPNs.• Works with anything. It protects existing infrastructure investment by enabling strong security on

legacy devices which may not support WPA2-Enterprise mode. • Goes the distance. It provides end-to-end security by extending encryption all the way from the

wireless client to the data center instead of at the access point, which would otherwise leave the distant bridge from data center to AP vulnerable.

• Mandated. Most powerful true end-to-end solution for Smart Grid addressing FIPS Cyber Security Meets the DoD 8100-2 directive for wireless use on the DoD “Grid” and is FIPS certified.

wirelesswall secure – versatile -proven ed smith – ceo wirelesswall, llc [email protected]...

Documents

wirelesswall security

wirelesswall platform

wirelesswall layer

security professionals

zoned security

data theft

wireless firewall

wirelesswall core technology