A big part of any organization’s digital transformation effort is to ensure that users have the ability to easily and securely onboard in order to connect to the appropriate applications, devices, and other users over the wired and wireless network. This is increasingly relevant, since bring-your-own-device (BYOD) initiatives continue to proliferate and users connect multiple devices, which means organizations have to contend with and defend a growing attack surface. In addition, most users will have a certain level of expectation (high) for access and delivery of services based on their experience at home (consumerization of IT).

Network onboarding is the mechanism by which BYOD, guest, and company-owned devices initially connect to the network. To be successful, the wired and wireless network onboarding process for authorized users and devices needs to be efficient, as well as easy to implement and manage—ideally without any hands-on involvement by IT (once deployed and configured). However, many organizations still rely on rudimentary onboarding methods that are built in to their network infrastructure (such as pre-shared keys and MAC authentication via captive portal) that can both impact user experience and create security risks.

Many organizations leverage onboarding mechanisms that are built in to the network infrastructure currently deployed in their environment (such as pre-shared keys and MAC authentication). However, given the rise of BYOD, IoT, and the need to provide guest access to Wi-Fi, this can lead to a number of challenges for organizations, including:

Another issue prevalent with these models is that users will either lose or forget their keys on a regular basis. This is quite common

If your organization is still using a legacy network onboarding mechanism, it could make it more attractive to attackers and put you at greater risk. To start, organizations need to understand what the current capabilities are and ask the difficult questions, like:

The answers to these questions will help organizations provide the justification required to move off a legacy solution. ESG research reveals that the three considerations most reported by respondents as most important in justifying IT investments to their organizations’ business management teams in 2018 were improved security, enhanced employee productivity, and improved customer satisfaction, as illustrated in Figure 1.³

• Performing health checks on devices prior to onboarding to ensure a minimum level of security per device and mitigate the risk of onboarding infected devices. Ideally, this would leverage a dissolving agent to reduce overhead in all devices.

• Providing the ability to deploy security policies based on role, department, or type of device, so users/devices only have access to what is appropriate for them.

• Authenticating valid users to connect to legitimate access points via digital certificates. This eliminates the possibility of attackers gaining access via pre-shared keys.

• Providing the ability to ID the user of any device on the network quickly and easily and revoke access if required to ensure improved risk management and/or incident response.

• Fully encrypting data over the air. Ideally this would be using the latest WPA2 (or WPA3 as this protocol becomes mainstream) to secure wireless data in flight. This mitigates the risk of attackers intercepting traffic.

• Integrating with the existing security ecosystem. Solutions should provide APIs to tie into third-party next-generation security solutions, thereby enhancing their effectiveness and creating a more robust defense-in-depth strategy.

• Providing an alternative mechanism for secure onboarding when digital certificates do not make sense. For example, often even IP-enabled IoT devices cannot accept a certificate and it’s not practical to expect a guest user to install a certificate when he is only in your environment for a short time. Look for solutions that have the potential to leverage dynamic keys for guests, which can provide similar security benefits.

With the frequency, severity, and sophistication of cyber attacks increasing, it will be imperative for IT to focus their time on architecting and building the appropriate defense posture, secure in the knowledge that device onboarding and authentication processes have automated workflows.

• Reduce the number of trouble tickets. Certificate-based systems eliminate the need to remember and/or continually enter keys, so IT staff can focus on architecture and strategic initiatives rather than user connectivity issues.

• Policy-based automation. Automated role-based access policies ensure that users have access to only what they need. The policies need to be easy to create and change to accommodate dynamic environments.

• Reduce time spent troubleshooting. Rapidly map suspicious devices to a user to mitigate risk and take corrective action immediately.

Role-based policies ensure that users only have access to what they are authorized to access. Cloudpath software also provides the ability to customize onboarding workflows by user (internal versus guest) and device type. This also ensures that operations has the ability to completely map devices to specific users should anomalous or suspicious activity arise.

Organizations with mature or emerging digital transformation initiatives need to start by ensuring that all the devices connecting to the network are properly vetted and authorized. Considering the wave of additional BYOD and IoT devices connecting to the corporate or guest network, it will be important for IT to have the appropriate visibility into all of these devices and the ability to act immediately if there is suspicious activity.

Security continues to be a top challenge for network and operations teams, and the rapidly expanding wired/wireless network environment presents an attractive attack surface that needs to be addressed. Organizations should not underestimate the risks of failing to properly secure network access and authentication in support of BYOD and guest users. While this may not be the first network security hole that comes to mind, it could be exactly where attackers may seek to focus.

In addition to providing a stronger security posture, leveraging automation to drive productivity, it is vital to remember that users expect a smooth experience with BYOD across an entire campus. Any solution deployed needs to provide a better experience for all users—employees and guests. Make sure that any solution you evaluate or select ticks all three justification boxes—enhanced security, improved employee productivity, and a better customer experience—to accelerate funding.

Network onboarding and authentication solutions that leverage digital certificates provide a number of advantages in an increasingly digital world. Organizations looking to upgrade should consider Ruckus Cloudpath Enrollment System to simplify their onboarding and authentication solution for complex heterogenous network environments.