	Background

Wireless networks extend the range of traditional wired networks by using  radio waves to transmit data to wireless-enabled devices such as laptops  and personal digital assistants. Typically, this identifier  is the name of the network. 2). Wireless Networks Provide Benefits and Present Challenges to Agencies

Wireless networks offer federal agencies two primary benefits: increased  flexibility and easier installation. Ease of installation is commonly cited as a key attribute of wireless  networks. In  implementing wireless networks, federal agencies face three overarching  challenges to maintaining the confidentiality, integrity, and availability of  their information:  protecting against attacks that exploit wireless transmissions,  establishing physical control of wireless-enabled devices, and  preventing unauthorized wireless deployments. If agencies do not establish effective controls for securing federal wireless  networks, federal information and operations can be placed at risk. By not managing signal leakage, agencies increase  their susceptibility to attack. Conclusions

Wireless networks can offer a wide range of benefits to federal agencies,  including increased productivity, decreased costs, and additional flexibility  for the federal workforce. However, wireless networks also present  significant security challenges to agency management. If these challenges are not addressed,  federal agency information and operations will be at increased risk. In  particular, agencywide security programs should include  robust policies for authorizing the use of the wireless networks,  identifying requirements, and establishing security controls for wireless- enabled devices in accordance with NIST guidance;  security configuration requirements for wireless devices that include  available security tools, such as encryption, authentication, virtual  private networks, and firewalls;  placement and strength of wireless access points to minimize signal   physical protection of wireless-enabled devices;  comprehensive monitoring programs, including the use of tools such as  site surveys and intrusion detection systems to  ensure compliance with configuration requirements;  ensure only authorized access and use of wireless networks; and  identify unauthorized wireless-enabled devices and activities in the  agency’s facilities; and  wireless security training for employees and contractors. Objectives, Scope, and Methodology

The objectives of our review were to  describe the benefits and challenges associated with securing wireless   identify the controls (policies, practices, and tools) available to assist  federal agencies in securing wireless networks,   analyze the wireless policies and practices reported by each of the 24  agencies covered by the Chief Financial Officers (CFO) Act of 1990, and   test the security of wireless networks at the headquarters of six major  federal agencies in Washington, D.C.
For the first three objectives, the scope of our review included (1) the 24  agencies under the CFO Act and focused on wireless networks conforming  to the 802.11x standard.
Why GAO Did This Study

The use of wireless networks is becoming increasingly popular. Wireless networks extend the range of traditional wired networks by using radio waves to transmit data to wireless-enabled devices such as laptops. They can offer federal agencies many potential benefits but they are difficult to secure. GAO was asked to study the security of wireless networks operating within federal facilities. This report (1) describes the benefits and challenges associated with securing wireless networks, (2) identifies the controls available to assist federal agencies in securing wireless networks, (3) analyzes the wireless security controls reported by each of the 24 agencies under the Chief Financial Officers (CFO) Act of 1990, and (4) assesses the security of wireless networks at the headquarters of six federal agencies in Washington, D.C.

What GAO Found

Wireless networks offer a wide range of benefits to federal agencies, including increased flexibility and ease of network installation. They also present significant security challenges, including protecting against attacks to wireless networks, establishing physical control over wireless-enabled devices, and preventing unauthorized deployments of wireless networks. To secure wireless devices and networks and protect federal information and information systems, it is crucial for agencies to implement controls--such as developing wireless security policies, configuring their security tools to meet policy requirements, monitoring their wireless networks, and training their staffs in wireless security. However, federal agencies have not fully implemented key controls such as policies, practices, and tools that would enable them to operate wireless networks securely. Further, our tests of the security of wireless networks at six federal agencies revealed unauthorized wireless activity and "signal leakage"--wireless signals broadcasting beyond the perimeter of the building and thereby increasing the networks' susceptibility to attack. Without implementing key controls, agencies cannot adequately secure federal wireless networks and, as a result, their information may be at increased risk of unauthorized disclosure, modification, or destruction.