Systems and methods for detection of unauthorized or unsecured access points
A method for detecting unauthorized or unsecured access points is disclosed. At least one node of a computer network having a wireless network interface is identified. At least one of the identified nodes is requested to scan for detectable wireless access points. A listing of identified wireless access points is utilizing information gathered through at least one of the scans. An inventory of authorized wireless access points is formulated. The listing is compared to the inventory to identify unauthorized wireless access points. Also, security information may be gathered and analyzed for identified wireless access points.
1. A computer-implemented method for detecting unauthorized access points, comprising:
identifying at least one node of a computer network having a wireless network interface, wherein the at least one node of a computer network comprises a managed computer node;
sending, from an administrative system, a request that at least one of the identified nodes scan for detectable wireless access points, a listing of the wireless access points being created, wherein the administrative system performs tasks for management of the at least one node, and wherein the tasks comprise:
software distribution;
software license monitoring; and
operating system imaging and migration;
utilizing information obtained through at least one of the scans;
formulating an inventory of authorized wireless access points based on the listing; and
comparing the listing to the inventory to identify unauthorized wireless access points;
the method further comprising:
receiving security information for at least one of the wireless access points from at least one of the identified nodes to create a composite security information, wherein the composite security information comprises:
a set service identifier (SSID) for at least one of the wireless access points;
an encryption type and an encryption status for at least one of the wireless access points; and
a medium access control (MAC) address filter status;
analyzing the composite security information; and
taking security measures with respect to the identified unauthorized wireless access points and based on the analysis of the composite security information.
2. The method of claim 1 , wherein taking security measures comprises sending an alert.
3. The method of claim 1 , wherein the managed computer node comprises a management agent that performs management-related tasks in response to one or more requests transmitted from an administrative system.
4. A computer system for detecting unauthorized access points, the computer system comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
identify at least one node of a computer network having a wireless network interface, wherein the at least one node of a computer network comprises a managed computer node;
send, from an administrative system, a request that at least one of the identified nodes scan for detectable wireless access points, a listing of the wireless access points being created, wherein the administrative system performs tasks for management of the at least one node, and wherein the tasks comprise:
software distribution;
software license monitoring; and
operating system imaging and migration;
utilize information obtained through at least one of the scans;
formulate an inventory of authorized wireless access points based on the listing; and
compare the listing to the inventory to identify unauthorized wireless access points;
wherein the system is further configured to:
receive security information for at least one of the wireless access points from at least one of the identified nodes to create a composite security information, wherein the composite security information comprises:
a set service identifier (SSID) for at least one of the wireless access points;
an encryption type and an encryption status for at least one of the wireless access points; and
a medium access control (MAC) address filter status;
analyze the composite security information; and
take security measures with respect to the identified unauthorized wireless access points and based on the analysis of the composite security information.
5. The system of claim 4 , wherein taking security measures comprises sending an alert.
6. A non-transitory computer-readable medium comprising instructions executable to detect unauthorized access points, the instructions being executable to:
identify at least one node of a computer network having a wireless network interface, wherein the at least one node of a computer network comprises a managed computer node;
send, from an administrative system, a request that at least one of the identified nodes scan for detectable wireless access points, a listing of the wireless access points being created utilizing information obtained through at least one of the scans, wherein the administrative system performs tasks for management of the at least one node, and wherein the tasks comprise:
software distribution;
software license monitoring; and
operating system imaging and migration;
formulate an inventory of authorized wireless access points based on the listing; and
compare the listing to the inventory to identify unauthorized wireless access points; the instructions being further executable to:
receive security information for at least one of the wireless access points from at least one of the identified nodes to create a composite security information, wherein the composite security information comprises:
a set service identifier (SSID) for at least one of the wireless access points;
an encryption type and an encryption status for at least one of the wireless access points; and
a medium access control (MAC) address filter status;
analyze the composite security information; and
take security measures with respect to the identified unauthorized wireless access points and based on the analysis of the composite security information.
7. The non-transitory computer-readable medium of claim 6 , wherein taking security measures comprises sending an alert.