Wireless Security
This chapter covers the following exam topics:
1.0 Network Fundamentals
1.11 Describe wireless principles
1.11.d Encryption
5.0 Security Fundamentals
5.9 Describe wireless security protocols (WPA, WPA2, and WPA3)
A comprehensive approach to wireless security focuses on the following areas:
Identifying the endpoints of a wireless connection
Identifying the end user (authentication)
Protecting the wireless data from eavesdroppers (encryption)
Protecting the wireless data from tampering (integrity)
Authentication
To use a wireless network, clients must first discover a basic service set (BSS) and then request permission to associate with it. Clients should be authenticated by some means before they can become functioning members of the wireless LAN.
A fake AP could also send spoofed management frames to disassociate or deauthenticate legitimate and active clients, just to disrupt normal network operation.
To prevent this type of man-in-the-middle attack, the client should authenticate the AP before the client itself is authenticated
Message Privacy
data should be encrypted for its journey through free space. This is accomplished by encrypting the data payload in each wireless frame just prior to being transmitted, then decrypting it as it is received. The idea is to use an encryption method that the transmitter and receiver share, so the data can be encrypted and decrypted successfully.
the AP should securely negotiate a unique encryption key to use for each associated client.
No other device should know about or be able to use the same keys to eavesdrop and decrypt the data.
The AP also maintains a “group key” that it uses when it needs to send encrypted data to all clients in its cell at one time. Each of the associated clients uses the same group key to decrypt the data.
Message Integrity
what if someone managed to alter the contents along the way? The recipient would have a very difficult time discovering that the original data had been modified.
A message integrity check (MIC) is a security tool that can protect against data tampering.
a way for the sender to add a secret stamp inside the encrypted data frame. The stamp is based on the contents of the data bits to be transmitted. Once the recipient decrypts the frame, it can compare the secret stamp to its own idea of what the stamp should be, based on the data bits that were received. If the two stamps are identical, the recipient can safely assume that the data has not been tampered with.
![1. Original Data 2. Compute MIC nihaol 23 nihao 123 6. Compare MICs 5. Compute MIC 3. Encrypt Data + MIC Client 4. Decrypt niha0123 741 fcb64901d
Wireless Client Authentication Methods
- Open Authentication
original 802.11 standard offered only two choices to authenticate a client: open authentication and WEP.
Open authentication is true to its name; it offers open access to a WLAN. The only requirement is that a client must use an 802.11 authentication request before it attempts to associate with an AP. No other credentials are needed.