Wireless and Mobile Device Security (BCY613D)

MODULE -5

CONTENTS

Dept of CSE-CY, RNSIT Page 1

 Wireless and Mobile Device Security (BCY613D)
Advanced Mobile Security and Risk Management

 Identify potential threats (e.g., data breaches, unauthorized access).

 Rank risks based on severity.
 Define mitigation strategies.
 Develop an official security policy based on the findings.

Each network has unique security challenges, but adhering to best practices ensures a robust and secure
network infrastructure.

Implementing basic security principles such as controlling RF leakage, optimizing AP placement, and
enforcing strong authentication methods provides a solid foundation for network security. While there
is no one-size-fits-all solution, designing with security in mind ensures a scalable, adaptable, and
resilient network against evolving threats.

WLAN Auditing Tools

After implementing a security-centric design, controlling access to the network is crucial. This can be
achieved through multiple, mutually reinforcing techniques, similar to the concept of defense in depth.
The first step is to hide the network, followed by authentication measures to prevent unauthorized users
from accessing it. Access restriction is not only applicable to external users but also to internal users
who need segmentation. When applied together, these techniques significantly reduce unauthorized
access risks.

SSID Integration with Identity-Based Access Integrating an SSID with identity-based access
methods, such as RADIUS authentication, is a recommended security practice.

SSID Obfuscation

SSID segmentation was commonly used in pre-Robust Security Network (RSN) environments based on
the IEEE 802.11i standard (02.11-2007). This involved creating different SSIDs for various user groups,
protocols, or departments. By linking an SSID to a virtual LAN (VLAN), network administrators could
segment users logically while ensuring secure access.

For example, even if users were connected to the same access point, they could be assigned to different
SSID/VLAN pairs, ensuring separation. Each SSID could have unique security settings, making this
approach scalable.

In SOHO networks, SSID segmentation is still widely used. Typically, three SSID/VLAN pairs are
created:

1. Guest SSID - No authentication, internet access only.

2. Voice SSID - Dedicated for voice traffic with Quality of Service (QoS) support.
3. Data SSID - Stronger security, authentication, and encryption.

Using SSID/VLAN pairs enhances security but requires significant configuration efforts for each access
point. In SOHO and SMB environments with around 20-30 access points, this remains manageable.
Dept of CSE-CY, RNSIT Page 2
 Wireless and Mobile Device Security (BCY613D)

However, excessive SSIDs increase management frames, affecting network throughput. Overuse of
SSIDs should be avoided to prevent MAC Layer overload, which can degrade performance.

SSID Cloaking

SSID cloaking is another technique that involves disabling SSID broadcasting in the access point
configuration. Since a client must discover, authenticate, and associate with an access point before
exchanging data, hiding the SSID prevents unauthorized users from easily locating the network.

When SSID cloaking is enabled, the access point transmits a beacon frame with a null SSID. Passive
network scans will not reveal the network, and even active scans with search probes will return a null
SSID, keeping the network hidden. This method can defeat scanning tools like inSSIDer but is not
foolproof. Attackers using protocol analyzers or tools like Kismet can still detect the network.

Weaknesses of SSID Cloaking

SSID cloaking has inherent vulnerabilities, including:

1. Authorized Clients Must Know the SSID - Clients need to be preconfigured with the SSID,
and when they send probe requests, an attacker monitoring traffic can capture the SSID.
2. Exposure to Eavesdropping - Attackers can intercept probe response frames containing the
MAC address, SSID, and BSSID.
3. Susceptibility to Social Engineering - Users manually entering SSID details increases the risk
of phishing attacks.

Despite its limitations, SSID cloaking remains a best practice for deterring casual or opportunistic
attackers. However, it does not prevent even moderately skilled hackers from accessing the network.
Therefore, it should be combined with other security measures, such as strong encryption and identity-
based authentication, for enhanced network protection.

Network Enumulator

Network Enumulator is a basic security measure that controls network access based on the unique
Media Access Control (MAC) addresses of devices. Each MAC address is a six-byte unique identifier
hardcoded into a device’s network interface, playing a crucial role in Layer 2 communications within
the OSI model. Unlike IP addresses, which can change, MAC addresses provide a fixed identifier for
devices in a network.

Importance of NE Filtering in Security

Since 802.11 WLANs function at Layer 2, they rely on MAC addressing for device identification. MAC
filtering operates on a “deny by default, permit by exception” basis, where only devices with pre-
approved MAC addresses can connect. While this approach is impractical for large networks, it is

Dept of CSE-CY, RNSIT Page 3

 Wireless and Mobile Device Security (BCY613D)

manageable in Small and Medium Businesses (SMBs) and Small Office/Home Office (SOHO)
networks, where the number of devices is relatively small.

Limitations and Criticism of NE Filtering

 Spoofing Vulnerability: MAC addresses can be spoofed, making this technique ineffective
against skilled attackers.
 Limited Effectiveness: While not foolproof, MAC filtering helps prevent casual,
opportunistic attacks and adds an additional security layer.

WLAN and IP Network Risk Assesment

Introduction

 Before the 802.11-2007 standard, Virtual Private Networks (VPNs) were widely used to secure
wireless user connections.
 VPNs were commonly implemented in:
o Inter-building wireless bridges (to securely link two or more buildings).
o Point-to-point wireless connections (to create encrypted links between remote
locations).
o Client station access (allowing wireless users to connect securely to corporate
networks).
 However, due to high overhead and performance degradation, VPN use for client station
access is now discouraged.

Impact of 802.11-2007 on VPN Usage

 With the introduction of the 802.11-2007 standard, Layer 2 security solutions became more
robust and well-defined.
 This made VPNs less necessary for securing wireless networks.
 However, VPNs are still relevant in some scenarios, particularly in Layer 3 applications, such
as:
o Remote point-to-point bridges (to secure wireless links between networks).
o Securing access point-to-access point communication (especially in multi-site
enterprise networks).
o Remote access to corporate resources from public networks or home offices.

Challenges and Downsides of VPNs in Wi-Fi Security

1. Layer 3 Operation and Security Risks

 VPNs function at Layer 3 (Network Layer) of the OSI model.

 This means an attacker can access both Layer 2 and Layer 3 connections before the VPN
tunnel is established.
 If an attacker gains this initial access, they can:
o Monitor unencrypted traffic.
o Launch man-in-the-middle (MITM) attacks.
Dept of CSE-CY, RNSIT Page 4
 Wireless and Mobile Device Security (BCY613D)
o Perform session hijacking.

2. Use of WEP Encryption for Additional Security

 Some administrators attempted to mitigate Layer 3 exposure by using WEP encryption

(Layer 2 security) in combination with VPNs.
 This added an extra encryption layer but led to significant downsides:
o Increased processing overhead (due to double encryption).

Dept of CSE-CY, RNSIT Page 5

 Wireless and Mobile Device Security (BCY613D)

o Reduced network performance and throughput.

o Limited security benefits, since WEP is outdated and easily broken.
 The need to balance security and performance made this approach inefficient and
impractical.

Best Practices for VPN Usage on Wi-Fi

1. Verifying Wi-Fi Networks

 Before connecting to any Wi-Fi network, ensure that it is legitimate.
 Hackers often create fake hotspots with names like “Free Wi-Fi” to lure unsuspecting users.
 To avoid falling victim to rogue access points, always:
o Confirm with the establishment (e.g., hotel, café, or airport) that the Wi-Fi network is
legitimate.
o Avoid connecting to open networks without encryption (i.e., networks without WPA2/WPA3
security).

2. Using a VPN on Public Wi-Fi

 VPNs are highly recommended when using public Wi-Fi networks in locations such as:
o Coffee shops
o Airports
o Hotels
o Shopping malls
o Restaurants
 A VPN encrypts all internet traffic, preventing hackers from:
o Intercepting sensitive data (e.g., passwords, credit card information).
o Performing packet sniffing to capture browsing activities.
o Exploiting security vulnerabilities in unencrypted connections.

3. Secure Remote Access

 VPNs remain crucial for remote employees who need to access corporate resources securely.
 Common VPN protocols used for secure remote access include:
o L2TP/IPsec (Layer 2 Tunneling Protocol with IPsec encryption)
o OpenVPN (open-source, highly secure VPN protocol)
o WireGuard (modern, fast, and lightweight VPN solution)
o SSL VPNs (web-based VPNs used for corporate remote access)

 While VPNs were once essential for securing wireless networks, they have become less critical due to
advancements in Layer 2 security (WPA2/WPA3 encryption).
 However, VPNs still play a vital role in:
o Securing remote access for employees and organizations.
o Protecting users on public Wi-Fi networks.
o Providing encrypted communication over untrusted networks.
 The best approach is to combine modern wireless security standards (WPA2/WPA3) with VPNs for
remote access, ensuring both strong Layer 2 security and encrypted Layer 3 communication.

Dept of CSE-CY, RNSIT Page 6

 Wireless and Mobile Device Security (BCY613D)

1. Mobile Communication Security Challenges

 VLANs (Virtual Local Area Networks) are logical network segments within a Layer 2
switched network.
 They help improve scalability, security, and performance by segmenting the broadcast
domain.
 VLANs allow devices to communicate as if they were on the same physical network, even if
they are physically separated across different switches or locations.

Key Features of VLANs

✅Logical network segmentation rather than physical segmentation.
✅Traffic isolation—devices in one VLAN cannot communicate with devices in another VLAN
without routing.
✅Broadcast control—reduces the impact of broadcast storms.
✅Enhanced security—prevents unauthorized access between VLANs.
✅Improved network performance—reduces congestion by controlling broadcast domains.
✅Flexibility—VLANs can be assigned based on MAC addresses, protocols, functions, or
applications.

2. Security Architecture

 A broadcast domain consists of all devices that receive the same broadcast messages.
 VLANs contain broadcasts within their own group, preventing them from spreading across the
entire network.
 This helps in reducing unnecessary traffic and enhancing performance.

VLAN Communication Between Hosts

 Devices within the same VLAN can communicate directly.

 Communication between VLANs requires a Layer 3 device (router or Layer 3 switch) to
bridge the VLANs.
 Without a router, devices in separate VLANs cannot communicate with each other.

Example VLAN and SSID Mapping

SSID Name VLAN ID Purpose

Corporate 10 Internal employee access

Guest Wi-Fi 20 Internet-only access

VoIP Phones 30 Prioritized voice traffic

IoT Devices 40 Isolated network for IoT devices

Dept of CSE-CY, RNSIT Page 7

 Wireless and Mobile Device Security (BCY613D)

 Example QoS Prioritization:

o Voice and video traffic → High priority (VLAN 30)
o General data traffic → Medium priority (VLAN 10, VLAN 20)
o Guest and IoT devices → Low priority (VLAN 40)

 VLANs provide logical segmentation, improving security, performance, and manageability

in both wired and wireless networks.
 In wired networks, VLANs reduce broadcast domains and improve traffic isolation.
 In wireless networks, VLANs segregate clients by mapping SSIDs to VLANs, enhancing
security and QoS.
 VLANs ensure that networks remain scalable, organized, and optimized for different user
groups.

Data Protection in Wireless Networks

1. Introduction to Wireless Data Protection

 Wireless networks transmit data over radio signals, making them vulnerable to unauthorized
access.
 Protecting both payload data and authentication credentials is crucial.
 The primary method for securing wireless communications is encryption.

Why Encryption is Necessary

✅Prevents eavesdropping by encrypting data in transit.
✅Protects authentication credentials from being intercepted.
✅Ensures data integrity by preventing unauthorized modifications.
✅Restricts unauthorized network access, reducing cyber threats.

2. Evolution of Wireless Encryption Standards

Over the years, various encryption methods have been used in Wi-Fi security. Some have been
deprecated due to weaknesses, while others remain strong and recommended.

Dept of CSE-CY, RNSIT Page 8

 Wireless and Mobile Device Security (BCY613D)

(A) WEP (Wired Equivalent Privacy) - Deprecated

Introduced: 1997 (part of original 802.11 standard)

Key Features:
 Used RC4 stream cipher for encryption.
 Used a static 40-bit or 104-bit key shared between all clients.
 Easily broken due to weak encryption algorithms.

Security Weaknesses:
❌Weak IV (Initialization Vector) made it vulnerable to replay attacks.
❌Shared key was static, making it easy to crack.
❌Easily compromised in minutes using modern tools (e.g., Aircrack-ng).

◻ WEP is considered obsolete and should not be used.

(B) WPA (Wi-Fi Protected Access) - Transitional

Introduced: 2003 as a temporary improvement over WEP.

Key Features:

 Introduced TKIP (Temporal Key Integrity Protocol) to fix WEP’s weaknesses.

 Used dynamic encryption keys that changed periodically.
 Still based on the RC4 cipher, which remained a weakness.

Security Weaknesses:
❌Still vulnerable to attacks like WPA PSK brute force and dictionary attacks.
❌RC4 encryption was still weak, making it possible to decrypt traffic.

◻ WPA is better than WEP but still not considered fully secure.

(C) WPA2 (Wi-Fi Protected Access 2) - Recommended

Introduced: 2004 as the official IEEE 802.11i security standard.

Key Features:
✅Uses AES (Advanced Encryption Standard) with CCMP (Counter Mode Cipher Block Chaining
Message Authentication Code Protocol).
✅Provides strong encryption and integrity checks.
✅Supports enterprise authentication via RADIUS servers for better security.

Security Strengths:
✔AES is highly secure and used in government and enterprise settings.
✔Dynamic key exchange prevents replay attacks.
✔Supports both personal and enterprise modes for different security needs.

Dept of CSE-CY, RNSIT Page 9

 Wireless and Mobile Device Security (BCY613D)

Security Weaknesses:
⚠ Vulnerable to brute force attacks if weak passwords are used.
⚠ KRACK (Key Reinstallation Attack) exploit discovered in 2017.

◻ WPA2 is widely used and secure for most environments.

(D) WPA3 (Wi-Fi Protected Access 3) - Latest & Strongest

Introduced: 2018 as the newest Wi-Fi security standard.

Key Features:
✅Uses SAE (Simultaneous Authentication of Equals) instead of WPA2-PSK.
✅Stronger encryption (192-bit in Enterprise mode).
✅Protection against offline dictionary attacks.
✅Forward secrecy prevents decrypted past data if the key is compromised.
✅Easier device onboarding for IoT and mobile users.

Security Strengths:
✔Resistant to brute force and dictionary attacks.
✔Enhanced security for public and open Wi-Fi networks.
✔More secure than WPA2, especially for sensitive data.

◻ WPA3 is the best available encryption standard and should be used where possible.

3. Best Practices for Wireless Data Protection

To ensure a secure wireless network, follow these best practices:

◻ Use WPA3 whenever available (or WPA2-AES as a fallback).

◻ Avoid WEP and WPA (TKIP) as they are no longer secure.
◻ Use strong passwords (at least 12-16 characters with symbols).
◻ Enable MAC address filtering (but be aware it can be bypassed).
◻ Disable WPS (Wi-Fi Protected Setup) to prevent brute-force attacks.
◻ Use a firewall and intrusion detection/prevention system (IDS/IPS).
◻ Keep routers and access points updated with the latest firmware.
◻ Segment guest networks using VLANs to keep them isolated from internal resources.
◻ Use VPNs for remote connections over public Wi-Fi.

 Encryption is critical for protecting wireless data and authentication credentials.

 Older encryption methods (WEP, WPA-TKIP) are insecure and should be avoided.
 WPA2-AES is the current standard, but WPA3 is the most secure option available.
 Implementing best practices ensures wireless security and reduces risks from cyber threats.

Dept of CSE-CY, RNSIT Page 10

 Wireless and Mobile Device Security (BCY613D)

Wired Equivalent Privacy (WEP)

1. Introduction

 WEP (Wired Equivalent Privacy) was introduced in the original IEEE 802.11 standard (1997).
 Its goal was to provide confidentiality, integrity, and access control for wireless networks.
 Encryption & Authentication:
o Static WEP keys were used for authentication.
o The same key was used for both authentication and encryption (a security flaw).

2. WEP Encryption Mechanism

 WEP encrypts the Layer 3 payload (IP packet) in an 802.11 frame.

 The payload, along with Layer 2 control packets, is called the MAC Service Data Unit (MSDU).

WEP Key Lengths:

1. 64-bit WEP (40-bit static key + 24-bit IV)
2. 128-bit WEP (104-bit static key + 24-bit IV)

 The Initialization Vector (IV) is a random 24-bit number added to the static key.
 Weakness: The IV is too short, leading to IV collisions and key reuse.

✔WEP encryption was widely used for years, but vulnerabilities emerged.

3. Weaknesses of WEP

A. Static Key Authentication

 Authentication & Encryption use the same static key.
 If the key is shared in cleartext, it can be intercepted and used by attackers.
 Configuration Confusion: Users had to enter hexadecimal keys manually, making it difficult for non-
technical users.
 Many devices shipped with security disabled by default, making networks vulnerable.

B. IV Collision Attacks
 WEP’s 24-bit IV is too small, leading to reused IVs (collisions).
 If an attacker captures enough packets, they can reconstruct the encryption key in under 5 minutes.
 Once the key is broken, all encrypted data can be decrypted.

C. Lack of Key Management

 Devices support multiple static WEP keys, but only one transmission key is used.
 Both sender and receiver must have the same key, making key distribution and management difficult.

Dept of CSE-CY, RNSIT Page 11

 Wireless and Mobile Device Security (BCY613D)

4. WEP Deprecation & Transition to WPA2

✔WEP is no longer a viable security method due to its severe vulnerabilities.

✔WPA2 and WPA3 are now the standard for Wi-Fi encryption.
✔If WEP is the only option (on older hardware), it is better than nothing, but highly discouraged.

5. Extensible Authentication Protocol (EAP)

 EAP is a framework for authentication in WLANs and point-to-point connections.

 It supports 40+ authentication methods and is used in WPA and WPA2.

✔Five EAP methods are approved for WPA/WPA2, providing stronger authentication than WEP.

 WEP was an early attempt at wireless security but failed due to design flaws.
 IV collisions, static keys, and weak encryption made WEP easy to crack.
 WPA2/WPA3 should always be used for modern Wi-Fi security.

WPA
Wi-Fi Protected Access (WPA)
Introduction

 WPA was introduced in 2003 by the Wi-Fi Alliance as an interim security solution to replace the
insecure WEP protocol.
 It was based on 802.11i and supported dynamic encryption key generation via Temporal Key
Integrity Protocol (TKIP).
 WPA was later replaced by the more secure WPA2.

WPA Authentication Methods

 SOHO (Small Office/Home Office): Used passphrase-based authentication (Pre-Shared Key or PSK).
 Enterprise Environments: Supported 802.1X/EAP authentication for stronger security.

✔This allowed backward compatibility with older hardware while improving security.

WPA Security Enhancements Over WEP

✔WPA used TKIP, which retained RC4 encryption but added new security mechanisms to address
WEP’s weaknesses:

A. Enhanced Key Mixing

Dept of CSE-CY, RNSIT Page 12

 Wireless and Mobile Device Security (BCY613D)

 WEP flaw: Simply added the IV (Initialization Vector) to the key before encryption.
 WPA fix: TKIP combined the secret encryption key with the IV before passing it to the RC4 cipher.
 Benefit: Made key-related attacks more difficult.

B. Replay Attack Prevention

 WEP flaw: Vulnerable to replay attacks, where an attacker could capture and resend encrypted
packets.
 WPA fix: Introduced a sequence counter to prevent packet replay.
 Benefit: Prevented attackers from replaying old encrypted messages to manipulate network activity.

C. Improved Message Integrity Check (MIC)

 WEP flaw: No strong data integrity verification, allowing attackers to alter packets.
 WPA fix: Added a 64-bit MIC (Message Integrity Check) to detect tampered packets.
 Benefit: Ensured that messages were not altered in transit.

⚠ Issue: The MIC keys were not encrypted, leaving a potential security loophole.

WPA Security Vulnerabilities

Despite these improvements, WPA was not perfect.

A. Beck-Tews Attack (2008)

 Exploited TKIP’s MIC mechanism to alter the Layer 3 payload without breaking encryption.
 Allowed data injection attacks, which could disrupt network integrity.

B. Ohagi/Morii Man-in-the-Middle Attack

 Extended the Beck-Tews attack using a man-in-the-middle approach.
 Did not reveal encryption keys, but could modify packets in transit.

✔Mitigation: Adjusting TKIP settings on WLAN controllers and access points helped prevent these
attacks.

Transition to WPA2 & WPA3

 TKIP-based WPA was deprecated due to security flaws.

 WPA2 (introduced in 2004) replaced TKIP with AES-based CCMP encryption for better security.
 WPA3 (introduced in 2018) further improved security with Simultaneous Authentication of Equals
(SAE) and stronger encryption.

✔WPA improved WEP but had its own security flaws.

✔TKIP vulnerabilities led to its deprecation in favor of WPA2.
✔WPA2 and WPA3 should always be used instead of WPA for secure Wi-Fi networks.

Dept of CSE-CY, RNSIT Page 13

 Wireless and Mobile Device Security (BCY613D)

WPA2;
Wi-Fi Protected Access 2 (WPA2)
Introduction

 WPA2 was designed as a long-term replacement for WPA, improving security significantly.
 It became the Wi-Fi Alliance's official standard for 802.11 security.
 Uses the Advanced Encryption Standard (AES) with Counter Mode Cipher Block Chaining
Message Authentication Code Protocol (CCMP) for strong encryption.

✔802.11n Amendment (2009): Stated that stations should not use WEP or TKIP when
stronger encryption is available.

Authentication Methods in WPA2

 SOHO Environments (Home & Small Offices): Uses WPA2-PSK (Pre-Shared Key), also called
WPA2-Personal.
 Enterprise Environments: Uses WPA2-EAP (Extensible Authentication Protocol) with 802.1X
authentication servers.

✔PSKs are 64 hexadecimal digits or an English passphrase (up to 133 characters), which is used to
generate unique encryption keys for clients.

Drawbacks of WPA2-PSK

⚠ Operational, not security-related:

 AES encryption requires more processing power, which can slow down older hardware.
 Legacy devices may need firmware upgrades to support WPA2.

✔Recommendation: Always use WPA2-PSK for home networks and WPA2-EAP for enterprise
networks.

WPA2 Security Mechanisms

A. WPA2 with AES (Advanced Encryption Standard)

 AES is a block cipher, replacing the stream cipher (RC4) used in WEP and WPA-TKIP.
 Used in IPSec VPNs and approved by the U.S. government for secure communications.

B. Block Ciphers vs. Stream Ciphers

Dept of CSE-CY, RNSIT Page 14

 Wireless and Mobile Device Security (BCY613D)

Feature Stream Cipher (e.g., RC4) Block Cipher (e.g., AES)

Encryption Approach Encrypts data bit-by-bit Encrypts fixed-size blocks (128-bit for AES)

Performance Faster, less overhead More secure, resistant to noise injection

Vulnerability Prone to synchronization issues More resistant to attacks

✔AES Key Sizes:

 AES-128: 10 encryption rounds

 AES-192: 12 encryption rounds
 AES-256: 14 encryption rounds

✔AES-128 and AES-256 are theoretically crackable but would take trillions of years, making them
practically unbreakable.

C. WPA2 with CCMP (Counter Mode CBC-MAC Protocol)

 CCMP replaces older protocols (WEP, TKIP) with AES encryption.
 Provides:
✔ Data confidentiality (encryption)
✔ Authentication
✔ Access control

✔CCMP encrypts Layer 3–7 payloads but not headers.

✔Uses Message Integrity Code (MIC) to prevent tampering.
✔RSN Compliance: CCMP is mandatory for modern security but requires upgraded hardware.

Security Order of Preference

WPA2 + CCMP (Best)

2⃣ WPA2 + AES
WPA + AES
WPA + TKIP
WEP
Open Network (No Security – Worst!)

Dept of CSE-CY, RNSIT Page 15

 Wireless and Mobile Device Security (BCY613D)
Advanced WLAN Security Measures:

Large organizations—and smaller ones with high-risk profiles—require more complex security
measures than SOHO networks. While the fundamental approach remains layered security, enterprises
must implement broader and more comprehensive protections. This chapter explores advanced wireless
security concepts, including both unique enterprise solutions and extensions of core security principles.

Comprehensive Security Policies

Establishing and Enforcing a Comprehensive Security Policy

Security Policy Overview

 A security policy defines rules and guidelines to protect an organization's information assets.
 It should align with business goals, resources, internal security needs, and regulatory
requirements.
 Wireless security is a crucial subset of the broader security policy.

 Devices should be assessed before connecting to the main network to prevent malware
infections.
 Methods:
o Basic authentication & security configuration checks.
o Restriction to a separate quarantine network until security updates are applied.
o Use of a "walled garden" or "captive portal" for remediation before full access is granted.

Compliance Considerations

 Compliance with external regulations (e.g., GDPR, HIPAA) is mandatory.

 Internal security policies must align with industry standards.
 Compliance demands can impact resources but also reinforce security best practices.

Implementing Authentication and Access Control

Authentication and access control are critical to securing wired and wireless networks. The IEEE
802.1X standard specifies Port-based Network Access Control (NAC) for Local Area Networks (LANs)
and Wireless LANs (WLANs), providing a robust authentication mechanism. The standard involves
three key components:

 Supplicant: The client device requesting access to the network.

 Authenticator: The network device (e.g., switch or access point) acting as a gatekeeper.
 Authentication Server: A server that validates credentials using protocols such as Extensible
Authentication Protocol (EAP) or Remote Authentication Dial-In User Service (RADIUS).

The authenticator blocks access until the authentication server verifies the client’s credentials.
Authentication can be based on username-password combinations, digital certificates, or other
credentials encapsulated in EAP over LAN (EAPoL) frames.

Dept of CSE-CY, RNSIT Page 16

 Wireless and Mobile Device Security (BCY613D)

EAP is a framework for secure authentication over networks, commonly used in both wired and wireless
environments. It creates a secure tunnel using Transport Layer Security (TLS) to transmit authentication
credentials.

Key Features:

 Supports multiple authentication methods, including passwords, digital certificates, biometrics,

and smart cards.
 Works in conjunction with RADIUS for network authentication.
 Can be used in different security protocols, including WPA2-Enterprise.

Note: Cisco’s Lightweight Extensible Authentication Protocol (LEAP) was an early implementation of
EAP, but it is no longer recommended due to security vulnerabilities.

Remote Authentication Dial-In User Service (RADIUS)

RADIUS is an AAA (Authentication, Authorization, and Accounting) protocol that provides centralized
authentication and access control for network users.
Authentication Process:

1. A user/device requests network access.

2. The Network Access Server (NAS) or access point forwards the authentication request to the
RADIUS server.
3. The RADIUS server validates the credentials against an authentication database (e.g., Microsoft
Active Directory).
4. If verified, the RADIUS server sends an access accept response, granting network access.
5. If verification fails, an access reject response is sent, denying network access.

Benefits of RADIUS Authentication:

 Centralized authentication management.

 Support for multiple authentication methods.
 Enhanced security through encryption and access policies.

Authentication Flow Using EAP and RADIUS

1. A supplicant requests access to the network.

2. The authenticator (access point or switch) forwards the request.
3. The authentication server initiates an EAP identity request.
4. The supplicant responds with credentials.
5. The authenticator forwards the EAP response to the RADIUS server.
6. The RADIUS server validates credentials and establishes a TLS-secured tunnel.
7. Authentication is completed, and access is either granted or denied.

This structured authentication process ensures that only authorized users and devices can access network
resources, mitigating security risks such as unauthorized access and credential theft.

Dept of CSE-CY, RNSIT Page 17

 Wireless and Mobile Device Security (BCY613D)

Implementing authentication and access control through 802.1X, EAP, and RADIUS strengthens
network security by ensuring that only verified users and devices can connect. These mechanisms
reduce vulnerabilities and enhance overall network integrity. Organizations should adopt centralized
authentication frameworks to improve security, compliance, and user access management.

Intrusion Detection/Prevention Systems

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are critical components of
network security. Both systems perform deep packet inspection to analyze packets moving through the
network.

 IDS (Intrusion Detection System): A passive security mechanism that detects and raises alerts
for suspicious activities without actively blocking traffic.
 IPS (Intrusion Prevention System): An active security mechanism that detects, alerts, and
prevents or blocks suspicious activities in real-time.

Both IDS and IPS rely on:

Dept of CSE-CY, RNSIT Page 18

 Wireless and Mobile Device Security (BCY613D)

 Signature-based detection: Identifying known attack patterns.

 Anomaly-based detection: Identifying deviations from normal network behavior.
 Protocol analysis: Ensuring traffic conforms to expected behavior for protocols such as HTTP,
DNS, and TCP/IP.

Wireless IDS/IPS (WIPS)

A wireless-specific version of IDS/IPS is referred to as Wireless Intrusion Prevention System

(WIPS). WIPS is vital for protecting Wi-Fi networks from threats such as man-in-the-middle attacks,
rogue access points, and denial-of-service (DoS) attacks.

Types of WIPS:

1. Network-based WIPS:
o Uses sensors configured in promiscuous mode to monitor all network traffic.
o A centralized server analyzes and presents the results.
2. Host-based WIPS:
o Installed as an application on endpoints (clients/servers) to monitor threats at the OS and
application level.
o Detects and blocks suspicious behaviors within the host device.

Protocol Filtering

Protocol filtering is a security mechanism used in wireless networks to control traffic at the access point
level. It can be applied in both inbound and outbound directions.

Types of Protocol Filtering:

1. EtherType Protocol Filtering:

o Blocks specific Ethernet frame types based on their EtherType value.
o Used to filter obsolete or unnecessary protocols to reduce attack surfaces.
o Example: Blocking EtherType IPX 802.2 (ISO designator 0x00E0) from legacy devices.
2. IP Protocol Filtering:

Dept of CSE-CY, RNSIT Page 19

 Wireless and Mobile Device Security (BCY613D)

o Blocks specific IP-based protocols using well-known port numbers.

o Restricts the use of insecure or unnecessary protocols within the WLAN.
o Can be configured to allow access only from specific source IPs.
o Example: Allowing SNMP traffic only from a designated network management server.

Authenticated Dynamic Host Configuration Protocol (DHCP)

Authenticated DHCP ensures that only verified users and devices receive network configurations,
preventing unauthorized access.

Methods of Implementing Authenticated DHCP:

1. Captive Portal Authentication:

o Users attempting to connect are redirected to a web-based authentication portal.
o Upon successful login (via RADIUS, Active Directory, etc.), the user’s device is granted
an IP address with full network access.
2. 802.1X Port Control:
o Initially blocks all network traffic except for authentication messages (EAPoL frames).
o Upon successful authentication via RADIUS, the logical network port is opened for full
traffic flow.
o Prevents unauthorized devices from receiving IP addresses via DHCP before
authentication.

IDS and IPS play a crucial role in network security by detecting and preventing attacks. WIPS extends
this protection to wireless networks, ensuring comprehensive security against threats such as rogue
access points and protocol misuse. Additional security mechanisms like protocol filtering and
authenticated DHCP further enhance security by controlling access and restricting unauthorized devices.
Implementing these security measures strengthens the overall resilience of an organization’s network
against cyber threats.

Advanced Data Protection: WPA2 Modes, VPN, IPsec;

Data Protection in Wireless Security
1. Importance of Data Protection in Wireless Security

 Prevents unauthorized access, data replication, and theft of sensitive information.

 IEEE 802.11i standard (ratified in June 2004) was introduced to address weaknesses in earlier
data-protection methods.
 WPA2 (Wi-Fi Protected Access 2) is recommended for organizations concerned about
network and information security.
 Two primary modes of WPA2:
o WPA2-PSK (Pre-Shared Key) for small/home offices (SOHO).
o WPA2-Enterprise for larger organizations with higher security needs.

2. 802.11i Standard Security Requirements

Dept of CSE-CY, RNSIT Page 20

 Wireless and Mobile Device Security (BCY613D)

 Authentication Mechanism: Uses 802.1X for Enterprise mode to ensure strong user
authentication.
 Encryption and Integrity:
o Uses AES-CCMP (Advanced Encryption Standard - Counter Mode Cipher Block
Chaining Message Authentication Code Protocol) for data confidentiality and
integrity.
o CCMP has built-in integrity mechanisms, eliminating the need for additional integrity
protocols.
o Ensures secure encryption of wireless communication and prevents tampering.

3. WPA2: Personal vs. Enterprise Modes

WPA2-Personal (PSK Mode)

 Used in small businesses and home networks.

 Uses a pre-shared key (PSK) for authentication.
 Easy to configure but has limitations:
o Passphrase must be manually updated across all devices if changed.
o If an employee leaves, they could retain access unless the passphrase is changed.

WPA2-Enterprise Mode

 Designed for large organizations where user management is crucial.

 Uses RADIUS-based authentication with 802.1X authentication.
 Each user is authenticated individually using a Network Policy Server (NPS).
 Advantages of WPA2-Enterprise:
o Eliminates shared passphrase issues (users don’t need to enter a shared key).
o More secure—if an employee leaves, their credentials can be revoked without affecting
others.
o Uses a secure tunnel connection to encrypt session keys during authentication.

4. WPA3: The Next Generation of Wireless Security

 Introduced in 2018 as an upgrade to WPA2.

 Addresses key security weaknesses in WPA2, especially related to password protection.
 Offers four major security improvements:
1. Secure handshake: Replaces WPA2’s 4-way handshake with Simultaneous
Authentication of Equals (SAE) to prevent offline dictionary attacks.
2. Easier onboarding of new devices: Enhances security for IoT devices.
3. Better security for public Wi-Fi: Encrypts traffic on open networks using
Opportunistic Wireless Encryption (OWE).
4. Stronger encryption keys: WPA3-Personal uses 128-bit encryption, and WPA3-
Enterprise requires 192-bit encryption for high-security environments.
 Only the new handshake (SAE) is mandatory; other features are optional.

5. Internet Protocol Security (IPSec)

Dept of CSE-CY, RNSIT Page 21

 Wireless and Mobile Device Security (BCY613D)

Definition and Purpose

 IPSec (Internet Protocol Security) is a suite of open-standard security protocols for securing
IP-based communications.
 Used to encrypt and authenticate every packet in an IP communication stream.
 Commonly used in point-to-point and client-server configurations.

IPSec Security Components

 Authentication Header (AH):

o Provides authentication and integrity verification for packets.
o Protects against replay attacks but does not encrypt data.
 Encapsulation Security Payload (ESP):
o Provides data confidentiality (encryption) along with authentication and integrity.
o More commonly used than AH.
 Security Associations (SA):
o Defines security parameters for AH and ESP operations.
o Determines how IPSec encrypts and authenticates traffic.

IPSec Operational Modes

1. Transport Mode:
o Encrypts only the payload (data), leaving the IP header intact.
o Used for end-to-end communication between individual devices.
o Limitation: IP addresses must remain unchanged for authentication to remain valid.
2. Tunnel Mode:
o Encrypts the entire packet, including the IP header.
o Used for VPNs (Virtual Private Networks) and router-to-router secure
communication.
o Common in backhaul links, site-to-site VPNs, and secure remote access.

Challenges of Implementing IPSec

 Complexity in large IPv4 networks: Requires multiple tunnels, making configuration

challenging.
 High overhead in large deployments: Number of required tunnels grows exponentially (n × (n
– 2)).
 Trade-off between security and performance: Some enterprise applications (e.g., VoIP)
require low-latency communication, which can be impacted by IPSec encryption overhead.
 Built-in support in IPv6: Simplifies IPSec deployment compared to IPv4.

6. Summary of Key Takeaways

Security Feature Purpose Key Benefit

Defines wireless security
802.11i Standard Ensures strong authentication and encryption
protocols

Dept of CSE-CY, RNSIT Page 22

 Wireless and Mobile Device Security (BCY613D)

Security Feature Purpose Key Benefit

WPA2-PSK Used in small networks Simple setup but requires manual passphrase updates
WPA2- Uses RADIUS
Scalable, secure, and eliminates shared passphrase risks
Enterprise authentication
Modern wireless security Stronger encryption, improved password security, better
WPA3
standard protection for public networks
Encrypts and authenticates
IPSec Secure remote communication and VPNs
IP traffic
IPSec Transport
Encrypts only the payload Used for end-to-end encryption between devices
Mode
IPSec Tunnel
Encrypts the entire packet Used in VPNs and secure backhaul links
Mode

Virtual Private Networks (VPNs) & Malware and Application Security

1. Virtual Private Networks (VPNs)

Definition & Importance

 VPNs are crucial for secure remote access to wireless networks, especially over unsecured public
networks (e.g., coffee shops, airports, hotels).
 They extend the corporate private network over the Internet using encryption and authentication
protocols.
 VPNs create secure point-to-point connections through virtual tunneling protocols and private key
exchanges.

Types of VPNs

VPNs are categorized based on how they connect users to the corporate network:

1. Remote Access VPN

o Allows individual employees to securely connect to their organization’s network while working
remotely.
o Used when employees are traveling or working from client sites.
o Encrypts communication between the remote device and the corporate network to prevent
eavesdropping and cyber threats.
2. Site-to-Site VPN (Fixed-Point VPN)
o Connects branch offices or satellite locations to the corporate headquarters securely.
o Establishes a persistent, encrypted connection between two or more office locations.
o Ideal for organizations with multiple offices that require secure internal communication.

Security Features of VPNs

VPNs ensure:

Dept of CSE-CY, RNSIT Page 23

 Wireless and Mobile Device Security (BCY613D)

 Confidentiality – Encrypts transmitted data to prevent unauthorized access.

 Data Integrity – Ensures transmitted data is not altered during transit.
 Source Authentication – Verifies that only authorized users or devices connect to the VPN.

WLAN Discovery Tools

 WLAN discovery tools help analyze, troubleshoot, and optimize wireless networks.
 These tools exist as open-source utilities and professional enterprise suites.
 Many older tools were designed for legacy Wi-Fi standards (802.11a/b/g) and may not support newer
standards like 802.11n, 802.11ac (Wi-Fi 5), and 802.11ax (Wi-Fi 6).
 Hardware compatibility is crucial—you cannot capture 802.11ac packets with an 802.11a/b/g/n
adapter.

Challenges with Newer Wi-Fi Standards

 802.11n and later introduce MIMO (Multiple Input Multiple Output) and Transmit Beamforming
technologies.
 These require specialized Wi-Fi adapters and monitoring software.
 Basic tasks like device discovery, site surveys, and signal strength measurements work on most tools.
 Traffic analysis and reporting require specialized tools that support advanced Wi-Fi standards.

2. Enterprise Wi-Fi Audit Tools

Professional Wi-Fi Network Management

 Large organizations invest in integrated Wi-Fi audit tools for traffic analysis, site surveys, and
security assessments.
 Popular enterprise Wi-Fi management solutions:
o Cisco AWS
o Aruba Airwave
o AirMagnet WiFi Analyzer (NetAlly)

AirMagnet WiFi Analyzer (NetAlly)

Dept of CSE-CY, RNSIT Page 24

 Wireless and Mobile Device Security (BCY613D)

 Comprehensive enterprise Wi-Fi monitoring and auditing tool.

 Supports 802.11a/b/g/n/ac/ax real-time traffic analysis.
 Provides insights into connectivity, capacity, coverage, performance, throughput, and security
vulnerabilities.
 Generates regulatory compliance reports for PCI, SOX, and ISO standards.

Key Features:

✔Wi-Fi traffic analysis

✔Automatic troubleshooting
✔Wi-Fi interference detection
✔WLAN client roaming analysis

3. Budget-Friendly Professional Wi-Fi Tools

Acrylic WiFi
 Affordable alternative to AirMagnet WiFi Analyzer.
 Advanced Wi-Fi scanner and site survey tool for Windows systems.
 Supports 802.11a/b/g/n/ac/ax, 2.4 GHz & 5 GHz networks.
 Visual dashboard for signal strength, channel interference, and network optimization.

IT Security Management

Demilitarized Zone (DMZ) Segmentation

Demilitarized Zone (DMZ) segmentation is a widely used security strategy to separate visitor access
from the corporate network. A DMZ acts as a buffer zone between the public Internet and an
organization's internal network. It allows external users to access public services while preventing direct
access to sensitive corporate resources.

Device and Network Management

Managing Network and User Devices
Overview
 Larger organizations face challenges in managing both network infrastructure and client (user)
devices.
 Unlike small organizations, IT staff in large organizations may not know all users personally.
 Users often have multiple devices, increasing network complexity and strain on IT and security
teams.
 The management of network and user devices is crucial for maintaining security, efficiency, and
performance in large-scale environments.

Simple Network Management Protocol Version 3 (SNMPv3)

Definition and Functionality

Dept of CSE-CY, RNSIT Page 25
 Wireless and Mobile Device Security (BCY613D)

 SNMP is an Application Layer protocol that facilitates communication between a Network

Management System (NMS) and host agents.
 It enables monitoring, managing, and troubleshooting network devices remotely.
 Access points support SNMP alerts and can send information about network status to an NMS.
 If an Agent Message Information Base (MIB) is installed and enabled, it provides detailed
network statistics to the NMS.

SNMP Alerts (Traps)

 Alerts include:
o Interface status changes (up/down)
o Authentication failures
o Lost neighboring devices
o Significant network events requiring immediate attention
 The NMS interrogates the MIB periodically, collecting key performance indicators such as:
o Interface throughput
o Packet loss
o Network latency and jitter

Security Features of SNMPv3

 SNMPv3 is the only SNMP version that provides strong security and should be the only
version used in modern networks.
 Security measures include:
1. Message Integrity: Uses hash codes to ensure data packets are not tampered with.

Dept of CSE-CY, RNSIT Page 26

 Wireless and Mobile Device Security (BCY613D)

2. Authentication: Confirms messages originate from valid devices.

3. Encryption: Encrypts messages to prevent eavesdropping.

Server Groups vs. Communities

 Unlike SNMPv2, which uses communities for access control, SNMPv3 employs server groups.
 Administrators must configure the server group with an access control list (ACL) to define
authentication permissions.

Migration from SNMPv2 to SNMPv3

 Older devices may still support SNMPv2, leading to mixed environments.

 Firmware upgrades should be implemented to transition devices to the more secure SNMPv3.

Discovery Protocols

Importance of Discovery Protocols

 Discovery protocols enhance network efficiency by facilitating:

o Lightweight Access Point/Controller Implementations
o Voice over WLAN (VoWLAN) optimization
 They allow devices to identify and communicate with each other, simplifying network
management and troubleshooting.

Security Concerns

 Discovery protocols can expose critical network information to unauthorized users.

 Hackers can exploit these protocols to map networks, identify vulnerabilities, and locate
critical infrastructure.

Common Discovery Protocols

1. Cisco Discovery Protocol (CDP)

o Proprietary to Cisco devices.
o Enables device identification and topology mapping.
o Used for troubleshooting and configuration.
o Potential security risk due to exposure of network details.
2. Link Layer Discovery Protocol (LLDP)
o Vendor-neutral alternative to CDP.
o Provides device discovery and topology information.
o Also poses a security risk if misconfigured.

Other Discovery and Service Discovery Protocols with Security Risks

1. Universal Plug and Play (UPnP)

o Allows automatic device discovery and communication.
o Frequently targeted by hackers due to weak authentication mechanisms.

Dept of CSE-CY, RNSIT Page 27

 Wireless and Mobile Device Security (BCY613D)

2. IPv6 Neighbor Discovery Protocol (NDP)

o Facilitates address resolution and device interaction in IPv6 networks.
o Vulnerable to spoofing and denial-of-service (DoS) attacks.
3. Web Proxy Autodiscovery Protocol (WPAD)
o Automates proxy configuration for networked devices.
o Susceptible to man-in-the-middle (MITM) attacks, allowing attackers to intercept
internet traffic.

Mobile Device Security Models

1. Enforce SNMPv3 for secure network monitoring.

2. Disable unnecessary discovery protocols to reduce attack surfaces.
3. Implement strong access controls and encryption to protect network management interfaces.
4. Use VLANs and segmentation to isolate sensitive devices and services.
5. Regularly update firmware to ensure compatibility with the latest security protocols.
6. Monitor network traffic and logs for signs of unauthorized access or anomalies.
7. Educate IT staff on security risks associated with SNMP, discovery protocols, and user device
management.

Managing network and user devices in large organizations requires a secure, scalable, and efficient
approach. Using SNMPv3 for network monitoring, minimizing exposure to discovery protocols, and
following best practices ensures the security, integrity, and performance of the organization’s IT
infrastructure.

Security Models

Modern autonomous access points are equipped with a variety of IP services to facilitate network
administration, security, and performance optimization. These services include DHCP, SSL certificate
management, NTP, QoS, and VPN support. While these services enhance network efficiency, they also
introduce security risks if not properly managed.

1. Common IP Services in Autonomous Access Points

Dynamic Host Configuration Protocol (DHCP) Server

 Automatically configures an IP address, DNS server address, and default gateway for clients.
 Enhances network management by dynamically assigning IPs instead of static configurations.
 Security Concern: An improperly secured DHCP server may allocate valid IP credentials to
unauthorized clients, potentially exposing the network to unauthorized access.

SSL Certificate Management Service

 Provides support for SSL trust certificates, particularly used in Extensible Authentication
Protocol-Transport Layer Security (EAP-TLS) authentication.
 Enhances secure communication and encryption of sensitive data.

Dept of CSE-CY, RNSIT Page 28

 Wireless and Mobile Device Security (BCY613D)

 Synchronizes network devices with a reference NTP server clock to ensure accurate
timekeeping.
 Security Concern: Attackers may spoof NTP requests, leading to denial-of-service (DoS)
attacks by amplifying response packets to overwhelm network resources.

 Prioritizes network traffic to optimize performance, especially for latency-sensitive applications

such as VoIP and video streaming.
 Assigns QoS values to protocols to ensure critical services receive necessary bandwidth and low
latency.

Virtual Private Network (VPN)

 Utilizes IPSec-type VPNs to secure remote access and inter-bridge connections in peer-to-peer
configurations.
 Ensures encrypted communication over potentially insecure networks.

2. Security Implications of IP Services

 NTP, DNS, and DHCP: Attackers can exploit these services to send spoofed requests, causing
excessive responses that overload network resources.
 Authenticated DHCP: Ensures only verified devices receive IP addresses, mitigating
unauthorized access risks.
 Proper SSL Certificate Management: Prevents unauthorized interception of encrypted
communication.

Device Management

Large-scale networks require carefully designed wireless topologies to ensure efficient coverage and
seamless user mobility.
Extended Service Set (ESS) and Access Point Architecture
 Networks utilize Extended Service Sets (ESS), where multiple access points (APs) aggregate
coverage across an organization.
 APs may share the same SSID for seamless roaming or have different SSIDs depending on
security policies.
 Overlapping AP coverage between 15-25% ensures uninterrupted roaming.
Types of Wireless Roaming Architectures
1. Seamless Roaming
o APs provide overlapping coverage to allow continuous network connectivity.
o Ideal for organizations requiring uninterrupted connections, such as hospitals or
corporate offices.
2. Nomadic Roaming
o APs have minimal overlap, causing a brief disconnect when switching networks.
o Often implemented for security purposes, forcing users to reconnect under different
security policies when entering a new area.
3. Collocation Design

Dept of CSE-CY, RNSIT Page 29

 Wireless and Mobile Device Security (BCY613D)

Involves overlapping APs to increase capacity rather than coverage.

o
Suitable for high-density environments like auditoriums or conference rooms.
o
4. Mesh Basic Service Set (MBSS)
o APs act as bridges to relay traffic across a network, especially useful in areas lacking
wired infrastructure.
o Commonly deployed in campuses where multiple buildings are wirelessly linked to a
central Ethernet network.

Encryption

 Control RF Power Levels: Adjust power output to limit network footprint.

 Strategic AP Placement: Optimize locations for minimal interference.
 Proper Antenna Selection: Use appropriate antennas based on the environment.
 RF Surveys: Conduct site surveys before deployment and expansion to assess signal strength,
interference, and coverage gaps.
 Encrypted Communications (VPN, TLS/SSL): Prevent data interception over insecure
networks.

IP services such as DHCP, SSL, NTP, QoS, and VPNs are essential components of modern wireless
network management, providing automation, security, and efficiency. However, these services also
introduce security risks if improperly configured. In addition, managing coverage areas and Wi-Fi
roaming is crucial for both performance and security, ensuring seamless connectivity while minimizing
exposure to threats. Finally, wireless client security outside the traditional network perimeter requires
robust security policies, including MDM, NAC, and encryption, to protect against evolving cyber
threats.

Dept of CSE-CY, RNSIT Page 30