CIOs cannot overestimate the amount of user education needed for a wireless LAN policy. Users don’t need to know how to tell a MAC address from an SSID, but they do need to know right from wrong. For example, they need to know about being tricked into accessing a wrong (and potentially malicious) access point that doesn’t belong to their organization. "It really requires that awareness of a new set of risks that this freedom permits," Selby says.

Next, CIOs all agree that any new wireless policy must dovetail with the existing wired policy. "You have to follow the same rules of the road for wireless that we follow in the wired environment," says Bryon Fessler, CIO and VP of IS for the University of Portland in Oregon. Since last year, Fessler has rolled out 50 access points in three buildings on campus, with plans for at least 25 more in the future. He takes every opportunity (face-to-face discussions, e-mails and other get-togethers) to ensure that the 4,500 students, faculty and university members understand the reasons behind his wireless LAN policies—why, for example, student laptops have to be quarantined, inspected for viruses and credentialed before they can connect to the WLAN.

Always Authenticate

Where wireless education ends, authentication and encryption technologies step in as the enforcers of policy—they’re the teeth when all the talking stops.

Authentication is one of CIOs’ first lines of defense. Boiled down, it is the ability to ensure that the client (laptop or other device) asking to latch on to the network signal is both what it claims to be and has been given permission to use the WLAN.

Right now, the 802.1x standard for port-based authentication, which originated in the wired networking world and has been retrofitted for WLANs because of the deficiencies of the wired equivalency protocol (WEP), is one of the top tools for credentialing users. The protocol behind 802.1x is called EAP, for extensible authentication protocol, and it uses encrypted tunnels to exchange information (user names and passwords) between device and network. According to WLAN vendor Aruba, although an intruder can monitor the exchange over the air, data inside the encrypted tunnel cannot be intercepted. Because EAP is used on wired networks, it’s attractive to CIOs pushing a unified network strategy. Its mutual authentication ability gives users the added protection that the network they’re seeing is actually legit—and not a hacker’s fake access point (referred to as an "evil twin"). Client-based software from vendors such as AirDefense and AirMagnet can help as well.