Your Firewall Can't Hear Radio

Take a slow walk around one of your sites. Skip the server room. Look at everything else.

At the front door, a badge reader checks every card that taps it. Over radio. In the elevator, an emergency phone waits to call out over a cellular line. In a utility closet, the alarm panel has a cellular backup in case the phone lines die. On the roof, wireless sensors report from the chillers. In a pump room at the edge of the property, a controller has a small 4G modem with an antenna screwed on top.

Every one of those devices is doing its job. And every one of them can talk without asking your firewall.

A guard at the front door

Your firewall is a good guard. It checks everything that comes through the front door of your network. Keep it.

But a guard at the front door can't see the window around back. A cellular modem is a window. So is a wireless gateway. So is a radio tucked inside equipment nobody listed when it showed up.

Traffic on those paths can skip the firewall completely. It may never show up in your logs. Your tools aren't broken. They're watching the wires, and this traffic isn't on the wires.

The device was never on the network map. It still had a way in.

This isn't a war on wireless

Radio is how modern buildings work. It's cheaper than cable, it reaches places cable can't, and it keeps working when the network goes down. That's why alarm panels and elevator phones depend on it.

The risk isn't radio. The risk is a radio link that's unknown, unowned, unneeded or acting strange. That's a blind spot. Attackers love blind spots.

Who owns the modem?

Ask three teams who owns the 4G modem in the pump room. IT says facilities. Facilities says the vendor. The vendor says it's yours now. Everyone is right. Nobody is watching.

That gap is where this book lives.