manufacturer of the equipment that is authorised to operate on the WLAN. This provides partial MAC filtering, since the first part of the MAC address indicates the equipment manufacturer. enabled since, prior to 802.11i, the 802.11 standards lacked the necessary key management mechanisms. As a result, responsibility for the security of information sent over the wireless connection rested firmly with the hotspot user. With the ratification of the 802.11i standard in 2004, the next generation of hotspot services will have the full range of security measures available, including the option of EAP and RADIUS based authentication and the full 802.11i pairwise and group key management mechanisms described in the Section "Wi-Fi Protected Access; WPA, p. 212". Until secure hotspot services become available, the technical and operational security measures described in Table 8-11 should be considered when using public hotspots. Secure Socket Layer Secure socket layer (SSL) is a layer 6 protocol that was developed by Netscape to protect confidential data being transmitted over the Internet, and relies on the public key infrastructure (PKI) to establish encryption keys. SSL supports several public key algorithms, including RSA (see Glossary), and several encryption ciphers, including RC4 and AES, the choice being negotiated when the secure connection is set up. Chapter Eight Table 8-11: Wireless Hotspot Security Measures Hotspot Security Measure Description Set up the wireless network Limiting automatic connection to an identified connection to only connect list of preferred access points will reduce the to preferred access points risk of connecting to an unknown access point. However, as SSIDs can be easily spoofed, this will not eliminate the risk from rogue access points. Use VPN for connecting to A VPN uses an additional level of encryption to a corporate network provide a protected "tunnel" through an insecure connection such as the Internet or a wireless hotspot connection. Install a personal firewall on A firewall act