Breaking In!

An active type of attack is when a wireless user actually breaks into
your network disguised as an authorized user. Even if you have taken
the precautions of encrypting your network traffic and blocking out any
unauthorized wireless NIC cards, a hacker could potentially steal an
authorized wireless NIC card or possibly bribe someone with after-hours
access to add the MAC address of an unauthorized NIC card into the
authorized list of users that the access point will accept.
Once the hacker gains access to your internal systems, he can corrupt,
steal, erase, or destroy confidential data pretty much anywhere in
your entire network. The hacker could potentially have access to your
systems for a long time if left unchecked, and could be stealing important
presentations, market information, pricing data, or research and
development information directly from your network for an extended
period of time. This type of attack is not uncommon.
The only way to combat a hacker is to have someone attuned to your
network bandwidth with extensive knowledge of all the users authorized
to access your wireless network. You must be very careful about
who has access to your information and during what hours this access
occurs. There are several methods of detection; the most common is to
monitor and log all your WLAN activity for access during off hours. During
business hours, you can check to see if there is an unusual amount
of network congestion, caused by a hacker consuming all available network
bandwidth while copying important data files from your server
directly. Most companies keep a log of at least 28 days, since only logs of
extended periods of time show any intrusion detection attempts to
access your system from an off-site location.
Detecting unauthorized attempts to access your WLAN is often complicated
by the fact that this medium (by design) has a high bit error
rate (BER) which often makes it appear that intrusion attempts and
unsuccessful access attempts are one and the same. When an access
attempt is not successful, this action is often seen as simply an unsuccessful
logon attempt. This makes it more difficult to track down intrusions
on WLAN than on wired LANs.