Chapter 7: Wireless network security (4hr)
1.1. Introduction to wireless security
1.1.1 Definition and need for wireless security
Wireless network security is the process of designing, implementing and ensuring security
on a wireless computer network. It is a subset of network security that adds protection to a
wireless computer network.
Wireless network security is also known as wireless security.
Wireless network security primarily protects a wireless network from unauthorized and
malicious access attempts. Typically, wireless network security is delivered through
wireless devices (usually a wireless router/switch) that encrypt and secure all wireless
communication by default. Even if the wireless network security is compromised, the hacker
is not able to view the content of the traffic/packet in transit. Moreover, wireless intrusion
detection and prevention systems also enable the protection of a wireless network by alerting
the wireless network administrator in case of a security breach.
Some of the common algorithms and standards to ensure wireless network security are
Wired Equivalent Policy (WEP) and Wireless Protected Access (WPA).
7.1.2. Types of Protocols used in wireless security
There are four wireless security protocols currently available:
Wired Equivalent Privacy (WEP): Wired Equivalent Privacy (WEP) is a security protocol, specified
in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11b. That standard is designed to provide a
wireless local area network (WLAN) with a level of security and privacy comparable to what is
usually expected of a wired LAN.
How WEP Works
WEP uses a data encryption scheme that is based on a combination of user- and system-
generated key values. The original implementations of WEP supported encryption keys of
40 bits plus 24 additional bits of system- generated data, leading to keys of 64 bits in
total length. To increase protection, these encryption methods were later extended to
support longer keys, including 104-bit (128 bits of total data), 128-bit (152 bits total), and
232-bit (256 bits total) variations.
When deployed over a Wi-Fi connection, WEP encrypts the data stream using these
keys so that it is no longer human-readable but can be processed by receiving devices.
The keys are not sent over the network but are stored on the wireless network adapter or in
the Windows registry.
Wi-Fi Protected Access (WPA): Wi-Fi Protected Access (WPA) is a security standard for
computing devices equipped with wireless internet connections. WPA was developed by the
Wi-Fi Alliance to provide more sophisticated data encryption and better user authentication
than Wired Equivalent Privacy (WEP), the original Wi-Fi security standard.
WPA was initially released in 2003. The Wi-Fi Alliance defined WPA as a response to
serious weaknesses found in the WEP protocol. A more secure version, WPA2, was released
in 2004. In 2018, the Wi-Fi Alliance announced the release of WPA's third and current
version, WPA3.
WPA works using discrete modes for enterprise and personal use. The most recent enterprise
mode, WPA-EAP, uses a stringent 802.1x authentication. The latest personal mode, WPA-
PSK, uses Simultaneous Authentication of Equals (SAE) to create a secure handshake.
The enterprise mode requires an authentication server, with which clients communicate
before sending login credentials.
Wi-Fi Protected Access 2 (WPA 2): WPA2 superseded WPA in 2004. WPA2 uses the
Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP). The
CCMP protocol is based on the Advanced Encryption Standard (AES) algorithm, which
provides message authenticity and integrity verification. CCMP is stronger and more
reliable than WPA's original Temporal Key Integrity Protocol (TKIP).
WPA2 still has vulnerabilities, however. Primary among those vulnerabilities is the potential
for unauthorized access to the enterprise wireless network. This happens when there is an
invasion of an attack vector on certain Wi-Fi Protected Setup (WPS) access points. It is
recommended the WPS be disabled for each attack vector access point in WPA2 to discourage
such threats. Other vulnerabilities exist in WPA2 as well, such as in Transport Layer Security,
which threat actors can target using downgrade attacks.
Though these threats have traditionally been directed at enterprise wireless systems, home
wireless systems with simple passwords or default passwords can be threatened as well.
Privileged accounts, such as administrator accounts, should always be supported by
stronger, longer passwords, and all passwords should be changed frequently.
Wi-Fi Protected Access 3 (WPA 3): Wi-Fi Protected Access 3, or WPA3, superseded
WPA2 in 2018. WPA3 is the latest, updated implementation of WPA. The Wi-Fi Alliance
began to certify WPA3-approved products in 2018. WPA3 support is not automatically
added to every device. Users who wish to use WPA3-approved devices, such as wireless
routers, must either buy new routers that support WPA3 or have the device updated by the
manufacturer.
New updates and features of WPA3 include:
• 256-bit Galois/Counter Mode Protocol encryption (GCMP-256)
• 384-bit Hashed Message Authentication Mode (HMAC)
• 256-bit Broadcast/Multicast Integrity Protocol (BIP-GMAC-256)
• an equivalent 192-bit cryptographic strength (in WPA3-EAP enterprise mode)
• SAE exchange and
• Wi-Fi Device Provisioning Protocol (DPP)
1.2. Understanding WLAN security models
Wireless networking enables computing devices with wireless capabilities to use
computing resources without being physically connected to a network. The devices simply
need to be within a certain distance (known as the range) of the wireless network
infrastructure. Wireless local area networks (WLANs) are groups of wireless networking
devices within a limited geographic area, such as an office building, that are capable of
exchanging data through radio communications. WLANs are usually implemented as
extensions to existing wired local area networks (LANs) to provide enhanced user mobility
and network access. WLAN technologies are based on the IEEE 802.11 standard and its
amendments. The WLAN security model has the following phases.
1. Configuration Design: Organizations should have standardized security configurations
for their common WLAN components, such as client devices and APs. A standardized
configuration provides a base level of security, reducing vulnerabilities and lessening the
impact of successful attacks.
Need Gathering: Before designing a WLAN security architecture or WLAN
component security configurations, an organization should gather information on
needs, particularly operational and security- related ones. This should include
identifying relevant WLAN security requirements from applicable laws, policies,
regulations, etc.
WLAN Architecture: When planning WLAN security, configuration designers
should consider the security not only of the WLAN itself but also how it may affect
other networks that are accessible through it, such as internal wired networks
reachable from the WLAN. An important principle of WLAN security is to separate
WLANs with different security profiles.
2. Configuration Implementation, Evaluation, and Maintenance: After designing a
WLAN security configuration, an organization should determine how the configuration will
be implemented, evaluate the effectiveness of the implementation, deploy the
implementation to the appropriate devices, and maintain the configuration and its
implementation throughout the devices’ lifecycles. Organizations should ensure that their
WLAN client devices and APs have configurations at all times that are compliant with the
organization’s WLAN policies.
Organizations should standardize, automate, and centralize as much of their WLAN
security configuration implementation and maintenance as practical, particularly for their
WLAN client devices and access points. This allows organizations to implement consistent
WLAN security throughout the enterprise, to detect and correct unauthorized changes to
configurations, and to react quickly when newly identified vulnerabilities or recent incidents
indicate a need to change the WLAN’s security configuration.
Organizations should evaluate all standardized WLAN security configuration
implementations carefully before deploying them throughout production environments.
Even if the organization is confident that the configuration is sound, it should still be
evaluated carefully to ensure that its implementation meets the organization’s particular
security and operational requirements. Every operating environment has unique
characteristics that should be taken into account. It is particularly important to evaluate the
strength of the configuration and its potential impacts on performance and functionality.
3. WLAN Security Monitoring: This section discusses two types of security monitoring:
assessments and continuous monitoring. A security assessment is “the process of
determining how effectively an entity being assessed meets specific security objectives.”
Security assessments are typically performed periodically, such as annually or quarterly,
and are often called periodic assessments. Continuous monitoring is defined in as
“maintaining ongoing awareness of information security, vulnerabilities, and threats to
support organizational risk management decisions.
3.1.1 Attack Monitoring: Organizations should continuously monitor their WLANs for
both WLAN-specific and general (wired network) attacks. The latter involves the same
security controls as would be used for any network-connected system in an organization.
WLAN-specific attacks can typically be divided into two types: passive and active. These
attack classes, which are significant for monitoring purposes, are described below.
• Passive attack: an attack in which an unauthorized party only monitors WLAN
communications; the attacker does not generate, alter, or disrupt WLAN communications.
There are two types of passive attacks:
1. Eavesdropping: The attacker monitors WLAN data transmissions for message
content.
2. Traffic analysis (also known as traffic flow analysis): The attacker gains
intelligence by monitoring the transmissions for patterns of communication. A considerable
amount of information is contained in the flow of messages between communicating parties.
• Active attack: an attack in which an unauthorized party generates, alters, or disrupts
WLAN communications. Active attacks may take the form of one of the following types:
Masquerading: The attacker impersonates an authorized user to gain access to certain
unauthorized privileges. o Replay. The attacker monitors transmissions (passive attack) and
retransmits messages posing as the legitimate user.
Message modification: The attacker alters a legitimate message by deleting, adding to,
changing, or reordering the message.
Denial of service (DoS): A DoS can occur inadvertently, such as other electronic devices
causing interference, or it can occur intentionally, such as an attacker sending large numbers
of messages at a high rate to flood the WLAN.
Misappropriation: The attacker steals or makes other unauthorized use of WLAN services.
A form of active attack that is particularly noteworthy is the deployment of rogue WLAN
devices. For example, an attacker deploys an AP that has been configured to appear as part
of an organization’s WLAN infrastructure. This can provide a backdoor into the wired
network, bypassing perimeter security mechanisms, such as firewalls. In addition, if client
devices inadvertently connect to the rogue AP, the attacker can view and manipulate the
client devices’ communications (e.g., man-in-the-middle attacks), as well as potentially
gaining access to the client devices themselves.
3.2 Monitoring Tools: One of the primary tools for WLAN security monitoring is a wireless
intrusion detection and prevention system (WIDPS). A WIDPS has sensors placed at
designated locations within an organization’s facilities; these sensors monitor WLAN bands
and channels to sample traffic, allowing them to identify WLAN attacks and some WLAN
vulnerabilities. WIDPS sensors are available in several forms:
• Dedicated: A dedicated sensor performs WIDPS functions but does not pass network
traffic from source to destination. Dedicated sensors are often completely passive, simply
sniffing WLAN traffic. Some dedicated sensors analyze the traffic they monitor, while other
sensors forward the traffic to a management server for analysis. The sensor is typically
connected to a wired network. Dedicated sensors are usually designed for one of two
deployment types:
• Fixed: the sensor is deployed to a particular location. Fixed sensors usually depend
on the organization’s infrastructure for power, wired network access, and other
resources.
• Mobile: the sensor is designed to be portable so it can be used from multiple locations
or while in motion. For example, a security administrator could use a mobile sensor
while walking through an organization’s buildings to find rogue APs.
• Bundled. Many APs and wireless switches offer some WIDPS capabilities as a
secondary function
3.3 Continuous Monitoring Recommendations: Organizations with WLANs should
implement continuous monitoring solutions for their WLANs that provide all of the
following detection capabilities:
▪ Unauthorized WLAN devices, including rogue APs and unauthorized client devices
▪ WLAN devices that are misconfigured or using weak WLAN protocols and
protocol implementations
▪ Unusual WLAN usage patterns, such as extremely high numbers of client devices
using a particular AP, abnormally high volumes of WLAN traffic involving a
particular client device, or many failed attempts to join the WLAN in a short
period of time
▪ The use of active WLAN scanners (e.g., war driving tools) that generate WLAN
traffic. The use of passive sensors cannot be detected through monitoring controls.
▪ DoS attacks and conditions (e.g., network interference). Many denials of service
attacks are detected by counting events during periods of time and alerting when
threshold values are exceeded. For example, a large number of events involving
the termination of WLAN sessions can indicate a DoS attack.
• Impersonation and man-in-the-middle attacks. For example, some sensors can detect
when a device is attempting to spoof the identity of another device. Organizations with
WLANs should also have the capability to identify the physical location of a detected
WLAN threat by using triangulation—estimating the threat’s approximate distance from
multiple sensors by the strength of the threat’s signal received by each sensor, then
calculating the physical location at which the threat would be the estimated distance from each
sensor. This allows an organization to send appropriate personnel, such as physical security
staff, to the location to address the threat.
3.4 Periodic Assessment Recommendations: Organizations with WLANs should conduct
regular periodic technical WLAN security assessments. These assessments should be
performed at least annually to evaluate the overall security of the WLAN. In addition,
organizations should perform periodic assessments at least quarterly unless continuous
monitoring of WLAN security is already collecting all of the information about WLAN
attacks and vulnerabilities needed for assessment purposes. For example, an organization
that does not have comprehensive WIDPS coverage of its facilities should use mobile
WIDPS sensors, WLAN scanners, or other tools with similar capabilities to search for rogue
WLANs in areas outside the WIDPS’s range.
The following are additional factors that organizations should consider when planning the
frequency and breadth of periodic assessments:
▪ The location of the facility being scanned, because the physical proximity of a
building to a public area (e.g., streets and public common areas) or its location in
a busy metropolitan area may increase the risk of WLAN threats
▪ The security level of the data to be transmitted on the WLAN
▪ How often WLAN client devices connect to and disconnect from the environment,
and the typical traffic levels for these devices (e.g., occasional activity or fairly
constant activity)—this is because only active WLAN client devices are
discoverable during a WLAN scan
▪ Physical changes to the facilities, such as construction projects that could affect
the strength and propagation of WLAN signals
7.3 Wireless security policies
A wireless network security policy for an enterprise. Consider the following
recommendations:
Activate 802.11 encryption to make data unintelligible to unauthorized users. WEP has
weaknesses, making it inadequate for protecting networks containing information extremely
valuable to others. There are some good hackers out there who can crack into a WEP-
protected network using freely-available tools. The problem is that
802.11 doesn’t support the dynamic exchange of WEP keys, leaving the same key in use for
weeks, months, and years. For encryption on enterprise networks, aim higher and choose
WPA, which is now part of the 802.11i standard. Just keep in mind that WPA (and WEP)
only encrypts data traversing the wireless link between the client device and the access point.
That may be good enough if your wired network is physically secured from hackers. If not,
such as when users are accessing important information from Wi-Fi hotspots, you’ll need
more protection.
Utilize IPSec-based Virtual Private Network (VPN) technology for end-to-end security.
If users need access to sensitive applications from Wi-Fi hotspots, definitely utilize a VPN
system to provide sufficient end-to-end encryption and access control. Some companies
require VPNs for all wireless client devices, even when they’re connecting from inside the
secured walls of the enterprise. A “full-throttle” VPN solution such as this offers good
security, but it becomes costly and difficult to manage when there are hundreds of wireless
users (mainly due to the need for VPN servers). As a result, consider implementing 802.11
encryption when users are operating inside the enterprise and VPNs for the likely fewer users
who need access from hotspots.
Utilize 802.1x-based authentication to control access to your network. There are several
flavors of 802.1x port-based authentication systems. Choose one that meets the security
requirements for your company. For example, EAP-TLS may be a wise choice if you have
Microsoft servers.
Establish the wireless network on a separate VLAN. A firewall can then help keep
hackers located on the VLAN associated with the wireless network from having easy access
to corporate servers located on different, more secured VLANs (i.e., not accessible from the
wireless network). In this manner, the wireless network is similar to a public network, except
you can apply encryption and authentication mechanisms to the wireless users.
Ensure firmware is up-to-date in client cards and access points. Vendors often implement
patches to firmware that fix security issues. On an ongoing basis, make it a habit to check
that all wireless devices have the most recent firmware releases.
Ensure only authorized people can reset the access points. Some access points will revert
back to factory default settings (i.e., no security at all) when someone pushes the reset button
on the access point. We’ve done this when performing penetration testing during security
assessments to prove that this makes the access point a fragile entry point for a hacker to
extend their reach into the network. As a result, provide adequate physical security for the
access point hardware. For example, don’t place an access point within easy reach. Instead,
mount the access points out of view above ceiling tiles. Some access points don’t have reset
buttons and allow you to reset the access point via an RS-232 cable through a console
connection. To minimize risks of someone resetting the access point in this manner, be sure
to disable the console port when initially configuring the access point.
Disable access points during non-usage periods. If possible, shut down the access points
when users don’t need them. This limits the window of opportunity for a hacker to use an
access point to their advantage as a weak interface to the rest of the network. To accomplish
this, you can simply pull the power plug on each access point; however, you can also deploy
power-over-Ethernet (PoE) equipment that provides this feature in a more practical manner
via centralized operational support tools.
Assign “strong” passwords to access points. Don’t use default passwords for access points
because they are also well known, making it easy for someone to change configuration
parameters on the access point to their advantage. Be sure to alter these passwords
periodically. Ensure passwords are encrypted before being sent over the network.
Don’t broadcast SSIDs. If this feature is available, you can avoid having user devices
automatically sniff the SSID in use by the access point. Most current computer operating
systems and monitoring tools will automatically sniff the 802.11 beacon frames to obtain the
SSID. With SSID broadcasting turned off, the access point will not include the SSID in the
beacon frame, making most SSID sniffing tools useless. This isn’t a fool proof method of
hiding the SSID, however, because someone can still monitor 802.11 association frames
(which always carry the SSID, even if SSID broadcasting is turned off) with a packet tracer.
At least shutting off the broadcast mechanism will limit access.
Reduce propagation of radio waves outside the facility. Through the use of directional
antennas and RF shielding, you can direct the propagation of radio waves inside the facility
and reduce the “spillage” outside the perimeter. This not only optimizes coverage, it also
minimizes the ability for a hacker located outside the controlled portion of the company to
eavesdrop on user signal transmissions and interface with the corporate network through an
access point. This also reduces the ability for someone to jam the wireless LAN - a form of
denial-of-service attack - from outside the perimeter of the facility. In addition, consider
setting access points near the edge of the building to lower transmit power to reduce range
outside the facility. This testing should be part of the wireless site survey.
Implement personal firewalls: If a hacker is able to associate with an access point, which
is extremely probable if there is no encryption or authentication configured, the hacker can
easily access (via the Windows operating system) files on other users’ devices that are
associated with an access point on the same wireless network. As a result, it’s crucial that
all users disable file sharing for all folders and utilize personal firewalls. These firewalls are
part of various operating systems, such as Windows XP and Vista, and 3rd party applications
as well.
Control the deployment of wireless LANs: Ensure that all employees and organizations
within the company coordinate the installation of wireless LANs with the appropriate
information systems group. Forbid the use of unauthorized access points. Mandate the use
of approved vendor products that you’ve had a chance to verify appropriate security
safeguards. Maintain a list of authorized radio NIC and access point MAC addresses that
you can use as the basis for identifying rogue access points.
***********