Download PDF

Installing and Configuring Oracle Application Server Wireless Security
Figure 10–4
Wireless LANs and Other HTTP-Based Devices
Without HTTPS security at the application layer, wireless LANs are insecure even
with the use of the Wired Equivalent Privacy (WEP) protocol, a protocol operating
at the data link layer designed to protect communication but which has been shown
to be insecure. Therefore, wireless networks that depend solely on WEP for privacy
are found to be vulnerable to "war-driving", an attack where the eavesdropper
’drives by’ with a wireless receiver to break WEP security and decode wireless
information.
Figure 10–5
Wireless Application Protocol (WAP)
Security in the Wireless Application Protocol (WAP) is currently specified in the
WTLS (Wireless Transport Layer Security) protocol. Similar in design to SSL (TLS),
but optimized for bandwidth and power, WTLS provides privacy from the wireless
device to the WAP gateway, allowing for server authentication and mutual
authentication modes.
WAP has been widely criticized by the security sector on what is commonly called
the ’WAP gap’, which breaks end-to-end communication data privacy. The WAP
device communicates with the WAP gateway through WTLS (the WAP pictured in
Figure 10–5) and the WAP gateway, in turn, communicates with the application
Wireless Security
10-15