TechSuccess: Intermec builds a wireless Fortress

By Brad Grimes

By Brad Grimes

|

As Defense Department agencies move to streamline supply-chain operations using wireless networks, they struggle to keep secure the growing number of 802.11b-based wireless networks.

IT solutions in action

Project: Defense Medical Logistics Standard Support program

Agency: Defense Department

Goal: The Defense Medical Logistics Standard Support program wanted to replace the old, 900-MHz, wireless handheld devices it had been using with new, flexible, 802.11b-based handhelds from Intermec.

Obstacle: The 802.11b standard, while widely accepted, is notoriously insecure. DMLSS needed a better way to lock down its various wireless networks that would meet Defense Department requirements. Virtual private networking was an option, but VPNs can be an administrative burden and impose unnecessary overhead on handheld devices.

Solution: Intermec, which was responsible for deploying 802.11b-based handhelds and access points across the DMLSS program, partnered with Fortress to integrate secure plug-and-play wireless gateways and thin client software that complied with the Defense Department's stringent security requirements.

Payoff: Using solutions from Fortress, DMLSS can rapidly bring its wireless LANs into security compliance. The Fortress solution gives DMLSS end-to-end encryption, from the handheld to the wired network, while extending secure authentication all the way to the client device and protecting its networks from malicious attacks.

"The mobile device is the true edge of the network, so it needs something to lock it down," said John Dow, Fortress Technologies' director of business development.

Fortress Technologies Inc.


New solution secures supply-chain networks without VPN



As Defense Department agencies move to streamline supply-chain operations using wireless networks, they struggle to keep secure the growing number of 802.11b-based wireless networks.

The 802.11b standard, the most cost-efficient and widely adopted wireless networking standard available, has become increasingly easy to deploy yet remains fundamentally insecure. That last fact led the Defense Department to issue a policy requiring that wireless networks had to meet stringent Federal Information Processing Standards for data encryption, the highest standard being FIPS 140-2.

Two years ago, the Defense Medical Logistics Standard Support program began replacing old 900-MHz radio devices with 802.11b handhelds and wireless access points from Intermec Technologies Corp. of Everett, Wash. The DMLSS program integrates medical supply chains for the Army, Navy and Air Force using wireless networks deployed in 198 hospitals worldwide to help expedite logistics tracking and inventory control.

According to George Moss, Intermec's director of government sales, DMLSS spends up to $4 million a year on its wireless networks. He said old devices had simply outlived their usefulness, and new, 802.11b-based, handheld devices gave the DMLSS opportunities to enhance its supply-chain applications.

"Security was not a big deal in the original 900-MHz system. I would challenge anyone to find their way in," Moss said. "It wasn't an issue, because there were no IP addresses. It was a very proprietary protocol. But 802.11b changed that."

The question was how would Intermec secure the 198 wireless networks that support the DMLSS program and bring them into compliance with FIPS standards?

Last August, the company began integrating security products from Fortress Technologies Inc., an Oldsmar, Fla.-based vendor that has deployed wireless security solutions for other Defense Department agencies, including the Defense Commissary Agency and the Defense Logistics Agency.

"Fortress was one of the first security vendors to get end-to-end FIPS certification," Moss said.

Traditionally, when organizations want to secure 802.11b-based wireless networks, the only solution available to them is virtual private networking. But VPNs can be cumbersome to deploy and difficult to manage. And when, like DMLSS, the organization uses handheld devices to connect to the wireless network, VPN technology can be especially difficult to use.

"We don't see as much use of VPN when the customer is using handheld devices, because of the management of the client software," said John Dow, Fortress Technologies' director of business development. "There's significant overhead associated with VPN clients."

VPNs do little more than initiate a wireless session and establish a secure tunnel to the wired network. As a general rule, they don't protect IP addresses and other network information, which leaves them vulnerable to denial-of-service attacks.

Dow said in government deployments, wireless security must extend all the way to the client by ensuring that the device is a trusted part of the network. Fortress does this through a system of access IDs, device keys and passwords that authenticate clients and users while hiding network information. Fortress also encrypts all communications from end to end.

"The mobile device is the true edge of the network, so it needs something to lock it down," Dow said. "The client software doesn't allow that device to communicate with anyone but a trusted member of the network."

"We had the Fortress technology tested by the NSA, and they validated that they could not break the algorithms," said Garry Duvall, deployment manager for DMLSS. "Now we can encrypt the data from the handheld, through the LAN and to the server."

The Fortress solution includes three main parts: a thin (100K) client program, a gateway connected to one or more access points and an access control server application that runs on the enterprise network.

Moss said the AirFortress Security Gateway is quick to deploy. The integrator connects the access points to the gateway, which acts as a secure bridge to the wired network. Minimal configuration is required. Intermec installs the AirFortress Secure Client software on its Microsoft Pocket PC-based handhelds, making the application transparent to users. The client software also supports wireless notebooks or network clients running Windows, DOS or other operating systems.

The number of gateways a network needs depends on the number of access points, but because of the low-bandwidth nature of supply-chain management applications, DMLSS can run their wireless networks, which typically comprise up to 15 access points, on five or fewer AirFortress gateways.

"We have the AirFortress going into 50 facilities today," Duvall said. "It will be in all our facilities in the next 18 months."

If you have an innovative solution that you recently installed in a government agency, contact Staff Writer Brad Grimes at bgrimes@postnewsweektech.com.

NEXT STORY: If you get this message, we're at FOSE ... why aren't you?