Hot Spots Are Just Not Good Enough

As the workforce becomes more mobile, and using mobile technologies are prerequisite for business executives, a market for subscription based Wi-Fi “hot spots” has emerged.  Providing connectivity in places such as coffee shops, fast food outlets, airports and hotels enables business travelers to find connectivity islands while on the road. Unfortunately, the hot spot model is not optimal for the itinerant business traveler.  Until executives decide to start hosting their critical business meetings over a Big Mac or Mocha Grande, this model falls well short of providing the connectivity where and when it is required to meet today’s business climate. 

Where business travelers need connectivity most is in conference and meeting rooms and they need it 24x7.  Today, most business people travel with Wi-Fi enabled laptops. These business people include visiting employees, customers, suppliers, partners, consultants, auditors, etc. Providing such visitors with courtesy access to the Internet does more than simply engender good will.  Enabling business visitors to get access to their mission critical data can make business meetings more productive, efficient and responsive to changing market conditions, competitive threats and business climate.  This can translate into an increased ability to attract customers which generates increased revenue, or translates into reduced costs.

Corporations have begun to examine the technologies available to provide connectivity to their visitors when they are on site, balancing the cost outlay in terms of capital and resources versus the productivity benefits and security risks presented.  The problem is how do corporations provide safe guest Internet access? Providing guest access can open up the corporation to the risk of someone conducting illegal or illicit activity while accessing the WAN via the corporate connection. This can happen without knowledge or accountability to the corporation. This can expose the corporation to the risk of not conforming to future FCC’s CALEA (Communication Assistance for Law Enforcement Agencies) mandatory requirements. 

The guest access solutions that are generally available in the market place today for the most part do not provide the required trusted environment for guest access. If they do manage to provide a secure solution then they are either too costly or too complex. Alternatively, they allow access to the internet that is secure but with severely limited functionality. Typical in house solutions currently available include the following:

Provide an open Wi-Fi connection: This solution results in completely open access for any visitor and provides no tracking of usage or abuse and completely exposes the enterprise to embarrassment if not a liability.

Provide temporary ID’s:  This solution places an administrative burden on the IT department, and often an IT resource has to be summoned in order to configure a visitor’s laptop and even worse load WEP keys.  Even if special visitor ID’s are used, unless the visitor provides detailed identity he or she can remain anonymous.

Provide Guest PC’s: This solution requires a substantial investment and only allows visitors to access the Internet and web based mail. Client based VPN access is therefore not possible.  

Dial up Access:  As the only PSTN line is usually the fax line, this solution normally results in an unplugged fax machine. In addition, dial access speed is slow, and one phone line is needed per visitor.

The challenge becomes one of authentication.  How do you guarantee the identity of an individual when they log onto your network?  Using email addresses is commonplace but these provide no tangible proof of a person’s identity.  Since we’re talking about mobile executives, we need to look at authentication methods that leverage technology that they already use.  The natural choice is the executive’s cell phone.  The executive’s cell-phone identity is secure and traceable via records with their wireless provider. With SMS technology, an application that leverages the authentication provided by the cell phone, companies that want to grant courtesy access can deliver a password to this device and know that each person on their network can be traced if needed.  No additional equipment configurations or system downloads are required, thereby minimizing any impacts of internal administrative or IT resources. The guest access alternatives are summarized in Table 1.

Table 1: Guest Access Alternatives

Options	Security	Availability	IT Impact	Cost
Instantly Available Self-Serve Traceable ID	Trusted: Authenticated and Traceable ID good at any SesameSpot	Instantly Available	Self Serve: User Standard Browser	An average of $1500/yr
Open Connection to Internet	None	Instantly Available	Network Configuration	Continual IT
Temporary ID's	Not Trusted: Provides outsider access to Internal LAN	Requires IT to create ID	Management of ID's, WEP keys, device configuration	Continual IT
Guest PC	Trusted: no email, or VPN	Available only to limited number of individuals	Maintenance of PC's: Virus, Configuration	PC's & IT
Dial Up Access	Trusted	Available only to limited number of individuals	Self Serve	One phone line per visitor

 

Trusted outsourced solutions that make guest access safe at the right cost must supply an ID for the visitor that is instantly available through a self-serve model.  Once the visitor uses his or her mobile phone number plus the SMS delivered password, they can securely be granted complimentary Internet access. Networked data centers record each guest’s access and location for an appropriate period, so that in the event of network abuse logged–in users can be traced, identified and if necessary excluded or disconnected. By using an outsourced networked solution provider, the visitor’s identity is valid at any enterprise that has subscribed to the same guest access solution. This results in a new level of consistent and simple Wi-Fi access that will enhance the usefulness and market acceptance of this low cost wireless technology.

The key to keeping guest Internet access costs acceptable is to introduce a guest access security model that complements securing employee access to the corporate LAN.   Security policies for guest Internet access must permit access that is ad hoc, instantly available, self provisioning (or say “easy to use”) but with at a much lower cost than the security model used to secure Wi-Fi access to the corporate LAN for employees. Guest access at the right cost means that the IEEE 802.11i standard being adopted for employees cannot be used for guests because it requires a pre-defined identity in the corporate authentication server, specialized software and custom configuration on each device before the end user can access the Wi-Fi network; the cost for guests is simply prohibitive.

The world is now becoming increasingly unwired and to be successful individuals and corporations need to introduce wireless technology or run the risk of becoming uncompetitive. Gone are the days when the acceptable outcome of a meeting is a list of actions that revolve solely on verifying data before a decision can be made. In today’s world, critical data must be accessible during the meeting allowing plans to be in motion even before the meeting concludes. The current hot spot deployment model for lighting up public spaces is not sufficient to bridge this connectivity gap for mobile executives. The new breed of solutions for providing Wi-Fi guest access in semi-public enterprise meeting rooms effectively moves to close this connectivity gap.

Tom S. Hope is President and CEO of Sesame Networks.

Visit Sesame Networks online.