GE MDS entraNET 900, Техническое руководство

Страница: 21 / 220

05-4055A01, Rev. E MDS entraNET Technical Manual 11
1.4.1 Intrusion Detection using SNMP Traps
In addition to the operative tools and techniques, the entraNET system
provides an SNMP-based network management system with traps
(alarms) that report suspicious activities or events. These include:
• Log-in attempt limit exceeded (accessed using HTTP)
• Successful log-in or logout (accessed using HTTP)
Denial of service, where Remote radios
could be reconfigured with bad
parameters, bringing the network down

Remote log-in

Local console log-in

HTTP (Hypertext Transfer
Protocol) and Telnet disabled,
enabling only local management
services
Airsnort and other war-driving intruders in
parking lots, near buildings, and so on

Frequency-hopping spread
spectrum (
FHSS ) does not talk
over the air with standard 802.11b
cards

The transceiver cannot be put in a
“promiscuous” mode

Proprietary data framing
Eavesdropping, intercepting messages

128- bit encryption
Key cracking

Automatic Key Rotation algorithm.
In addition, a Force Key Rotation
command is available to
immediately rotate the keys of the
AP and synchronize all Remotes
with it.
Replaying messages

128-bit encryption with rotating
keys
Unprotected access to configuration using
SNMP

Non-secure SNMP versions can be
enabled or disabled at will.

SNMPv3 password protection
Potential, ongoing attacks

Provides early warning using
SNMP through critical event
reports of unauthorized log-in
attempts and suspicious activities
Table 1-2. Security Risk Management
Security Risk The MDS entraNET Solution