Open WiFi: a Simple Risk Analysis

March 20th, 2006

Should you close and secure your WiFi access point (wireless Internet), or should you leave it open for all to use under a “good neighbor” policy? That’s the question that has been hashed about repeatedly in recent weeks over on the TechBlog. Today Dwight points us to an editorial that the Houston Chronicle has picked up from the New York Times; the essay by Tim Lee of the Show Me Institute asserts that there’s nothing wrong with leaving our WiFi connections open so that all comers might share our Internet connection. He goes on and on about the benefits of openly sharing our WiFi, but only briefly mentions the down side:

Security is another concern. Some are afraid that opening up their network will jeopardize their computers’ security. But the reality is that most of us have far more to fear from hackers on the Internet than from users parked across the street.

Dwight notes that Lee should know better, and thus is being disingenuous. I think this paragraph bears further examination, because it’s not just disingenuous, it’s also incomplete.

Here’s what I mean: in my day job, we practice something call “Risk Analaysis”. It’s a simple, but formal way of classifying risks of all kinds. We score each risk two ways: on the likelihood, which is the probability of something bad happening, and the consequence, or how bad would it be if that something did happen. We score likelihood and consequences on a scale of one to five, then use a grid to categorize the risk as green, yellow, or red, with red being the worst and requiring the most serious response. (Nothing in Risk Analysis is rocket science – it’s really just a formalized version of good, everyday common sense.)

Tim Lee’s paragraph above is incomplete because it talks only about likelihood and not consequence. It also doesn’t look at the different kinds of risk you expose yourself to in opening up your WiFi connection. I want to look more closely at the risks of opening your WiFi connection; I’m not shooting for a complete analysis, but I want to fill in a few of the blanks left by Tim Lee.

Risk number one: Someone uses my open WiFi connection to hack into my computer.

Likelihood: 1, Remote. Almost zero chance of this happening, especially in my quiet neighborhood. Depending on where you operate your access point, your likelihood might be higher. For example, if you’re running your WiFi network in a crowded apartment building or a college dorm, then score yourself much higher.

Consequence: 3. I don’t keep any sensitive data or passwords on my PC. Our checking account register is stored in Quicken, but it doesn’t include an account number. However, someone could do damage like wiping out all my files. I have backups, but recovering would be a pain, so I score this a middle of the road consequence. Your score could be higher, depending on what kind of data you have on your PC and whether you have a backup.

Risk score: Yellow.

Risk number two: Someone uses my open WiFi connection for illegal activity such as trading child porn, hacking third party sites, running a botnet, or conducting phishing attacks.

Likelihood: 1, Remote. Again, this seems unlikely for me, but your score might be higher depending upon where you operate.

Consequence: 5. This kind of activity can be traced back to my Internet connection, and from there the burden will be upon me to show that somebody else was the Bad Guy. “Innocent until proven guilty” won’t help me here, because the police won’t care about my open access point. Once they’ve got somebody to pin the blame on – me – they’ll stop looking.

Risk score: Yellow.

Risk number three: Someone uses my open WiFi connection for file sharing and runs afoul of the RIAA or the MPAA.

Likelihood: 3, Moderate. I give this one a higher probability of happening because so many people, even (especially?) in quiet suburban neighborhoods, don’t know or care that file sharing is a no-no. It’s more likely that my neighbors, or their kids, will engage in file sharing, and in the long run, there’s a higher probability that they will get caught.

Consequence: 5. A lawsuit by the RIAA typically costs three to five thousand dollars to settle. The costs go even higher if I fight and lose. Even though I’m not the one doing the sharing, I would be the one sued, and I would be the one to have to settle or fight the lawsuit, neither of which I want to do.

Risk score: Red.

So how do you deal with a risk once you’ve identified it? There are two options: you can accept the risk, which means you just live with it. The other option is to mitigate the risk, meaning that either you take steps to decrease the likelihood of the risk (you hope to eliminate it altogether) or you take steps to reduce the consequence of the risk by preparing for it in advance.

Only green risks can be accepted. Yellow and red risks must be mitigated. In the case of an open WiFi connection, I’ve identified two yellow risks and one red. I’ve chosen to mitigate these risks in the simplest way possible: by securing my WiFi connection. Not only have I turned on WAP, but I’ve also configured the router to accept only the MAC address of my laptop.

So, did I really have to go through all this analysis? Of course not! It was blatantly obvious to me from the minute I unwrapped my wireless router that I didn’t want to share my connection. The analysis is purely for the sake of discussion. Risk Analysis may be just formalized common sense, but common sense, as we all know, is often most uncommon.

Are there other risks than the ones I’ve identified? Without a doubt, but these are the three that seem to come up most often in discussions like those at TechBlog. Here’s one more to think about: If you’re the kind of person who leaves your WiFi access point wide open, then you’re probably also not the kind of person to install content-filtering software. Suppose the guy next door has installed porn-filtering software to protect his kids from the hardcore side of the Internet. Do you think that guy is going to think you’re being very “neighborly” when he discovers that tech-savvy little Johnny has been using your wide-open WiFi connection to browse hard-core porn sites? I’ll leave it to you to work out the risk analysis of that scenario.

Finally, let’s get back to Tim Lee’s assertion that you have more to fear from hackers on the Internet than from users parked across the street. Is he right? Maybe. Maybe not. The point is it doesn’t matter what the relative risks are, as long as you know there’s some risk from drive-by users. Once you have established that, then you have to protect yourself against them. Say what you like, Tim, I am not going to open up my WiFi to you. Let someone else take that risk.

3 Responses to “Open WiFi: a Simple Risk Analysis”

  1. Dwight Silverman Says:

    Nice work, Jim, though I’m dubious about the colored background text. At least you didn’t make it blink.

  2. Jim Says:

    Hmm… make it blink, eh? Hmmmmm…

  3. brem Says:

    My concern is more down to earth than yours, Jim. It’s economical.

    Basically, I don’t really care sharing my connection to my neighbours, provided they don’t download the episodes of the 6 seasons of The Sopranos on bittorrent. Even though my ISP has a high download bandwidth threshold allowed, it is easy to go over, and be overcharged. I’m not saying I did this ;) But if I did, it would cost me quite a bit of money. So I have my connection secured. I live a new and young neighbourhood, where houses are being built litterally in my backyard, so lots of new families. Thing is, I get about 3-4 good wi-fi signals, out of which, 2 are open. So when my own has its connectivity problems, I might invoke my non-written clause of using their connection to get my email or browse the internet. Bu I would never download big files through their network. Or should I and keep my mouth shut? :)