My company is setting up a combined wired and wireless network. In your opinion, what are the most serious concerns we'll have to contend with?
I'm going to assume that you've already chosen your hardware, so I'll focus on the most crucial factors in establishing reasonable network safety: securing mobile users, staying aware of potential security flaws, and managing usernames and passwords. First, mobile users are a major source of potential security problems. Be certain that all mobile systems are running personal firewalls to protect against viruses and worms. Also, define security policies that apply to all mobile users and make sure that the users are aware of these policies. I suggest you read the Web-exclusive article "Surviving the Sasser Worm," May 2004, http://www.winnetmag.com, InstantDoc ID 42645, and "Plug the Mobile Worm Hole," January 2004, InstantDoc ID 41112, and apply this information to mobile users and their systems.
Second, be sure that you consistently maintain and update security for all the applications on every system in your network, regardless of the OS you use. There seems to be a pervasive belief today that Windows is full of security holes whereas Linux is secure, but this belief primarily stems from the lack of mobile and desktop Linux configurations (and hence a much lower incidence of Linux-based security problems on those systems). Given Linux's open source code, virus writers could have a field day if they wanted. Whether you use Linux, UNIX, or Windows, be consistent and vigilant about monitoring and patching systems.
Third (and perhaps most important), be certain that users employ secure usernames and passwords. You wouldn't believe the disasters I've seen waiting to happen, such as users who use their initials as both username and password. And it isn't uncommon for these usernames and passwords to be available in clear text. Numerous password-cracking tools are available over the Internet, but even the most sophisticated will have a hard time determining a password that's a combination of letters, numbers, and symbols. Establish policies for user passwords and encourage users to follow the commonsense rules of password formation: 1) use a combination of characters as I explain above, 2) never divulge a password, and 3) never reuse a password. For more information about password security, read the Windows Scripting Solutions article "Randomize Password Expiration Intervals to Enhance Security," April 2003, InstantDoc ID 38064, and "Password Defense," September 2002, InstantDoc ID 25962.
Of course, as well as dealing with these three factors, you should follow common security practices such as encouraging users to lock their desktops or mobile systems and minimizing access to hardware (desktop systems as well as servers). For more suggestions, see "A Secure Wireless Network Is Possible," May 2004, InstantDoc ID 42273, and Mobile & Wireless, "Wireless Security Revisited," December 2003, InstantDoc ID 40706.