Fortunately, some standard alternatives to WEP are emerging. The Institute of Electrical and Electronics Engineers (IEEE) has defined an expansion to the 802.11 protocol that will allow for increased security. Unfortunately, the standard is presently in draft form and isn't expected to be ratified until the end of 2003. In the meantime, though, most of the Wi-Fi manufacturers have agreed to use a temporary standard for enhanced security called Wi-Fi Protected Access (WPA). Although WPA is a temporary protocol and isn't recognised by IEEE, it is very similar to the revised IEEE standard expected by the end of the year. Therefore, administrators that manage wireless LANs should become familiar with WPA.
802.1X authentication
If you have been using Wi-Fi for a while, you are probably familiar with the 802.1X authentication protocol. This protocol allows users to authenticate into a wireless network by means of a Radius Server. In standard Wi-Fi, 802.1X authentication is optional. However, 802.1X authentication is a requirement for WPA.
If your environment does not have a Radius server in place, you can still use WPA in spite of the 802.1X requirement. As an alternative to Radius, WPA supports the use of a pre-shared key.
WPA key management
One of the biggest drawbacks to traditional WEP security is that changing the encryption key is optional. Even if you do switch encryption keys from time to time, there is no option for globally re-keying all access points and all wireless NICs. Instead, re-keying is a tedious manual process and is completely impractical for large organisations. After all, the instant you re-key an access point, none of the clients will be able to access it until they are also re-keyed.
