Explain WLAN Security Needs

0:00[MUSIC PLAYING] Welcome to Explain Wireless LAN Security Needs. And furthermore, welcome to the CWSP course. It probably goes without saying these days, that network security is of the utmost importance. It needs to be an important part of any design, implementation, and maintenance or management of a network. That goes doubly true for wireless networks. Wireless networks are a major part of what we call the attack surface of a network.

0:30The attack surface is really just saying that we've got all these areas where we could be attacked. And certainly, wireless is a big part of that for a number of reasons. First of all, wireless is just expected everywhere-- pretty much every place is going to have wireless. And yet, the wireless signal that we are sending out does not respect the boundaries of my environment. A wired network can't go very far. It usually truly is contained within my physical space. Whereas, a wireless set of signals, it can go anywhere. It can go through walls.

1:01It can go out to my parking lot. If I'm in a leasing space, it might go directly into where other tenants are. And so I can't lock it down from a physical perspective, and therefore I'm going to have to lock it down using all kinds of other mechanisms. Over the course of time, we've seen a lot of attempts in the wireless world to actually lock down insecure networks. The good news is that, by and large, we've made a lot of progress. We look at introducing authentication and encryption. We look back at some of the early failures of WEP, and even to some extent, WPA and WPA2.

1:34And we've learned from these mechanisms. And so we've got new ones that hopefully will keep the bad actors at bay, at least until they come up with new strategies. But it's always this give and take. Ultimately, what we need to find out is, do we have a network deployment, or are we-- whether we're evaluating a network, or considering a new network deployment. Maybe we're designing one. Maybe we're installing one. But is this network going to be as secure as possible? Are we reducing the attack surface, and saying, OK, we're not going to be vulnerable to that security vulnerability, and that security vulnerability.

2:10But we can't wave a magic wand and just say, OK, this network is now secure. But we can take a lot of steps in ensuring that the network that we're deploying, or installing, or managing, is indeed secure. And that's the point of this course. If you're sitting here taking this, then you are probably looking at improving your knowledge and understanding of how to secure wireless networks, maybe with the goal of just simply doing a better job with the networks that we're responsible for, maybe with the goal of passing the exam and improving marketability, as well as the ability to really just get out there and use your skills in order to lock down networks.

2:47And maybe even you're trying to complete the CWNP set here, and we're maybe eyeing the CWNE, for example. So regardless of what your motivations are, we are here to really study and improve upon our ability to secure our wireless networks. So what are we here to talk about within this skill? Well, this skill is going to be a little bit of an overview skill. But we need to recognize what some of the challenges are that come to us from the wireless world. There's no point in talking about this fix, and that fix, and that fix, if we don't even recognize that there are problems with the way that wireless networking works.

3:23And when I say problems, what I really mean is that we're introducing risks into our environment, and potentially, we're introducing more of that attack surface. So we're introducing ways that our network can be compromised, sometimes without even realizing it. And we might think that flipping the switch to say, OK, I'm going to enable the best WPA security that this device has to offer-- maybe it's WPA2, maybe it's WPA3-- but unfortunately, flipping that switch, while it might protect me against those vulnerabilities, it will not protect me against those vulnerabilities.

3:56And so we need to start recognizing all of the different types of vulnerabilities that exist out there, and understanding that, fortunately, we have solutions for a lot of these vulnerabilities. So that's the purpose of the skill, is to really kind of put our thinking caps on and say, OK, we've got a bunch of vulnerabilities, we also have a bunch of solutions, and starting to match up some of those vulnerabilities to some of those solutions. Now, we're not going to go into all of the details in this skill. This is an introductory skill. So keep in mind, if you do have some questions afterwards about, well, wait a second, why does that particular configuration protect me against that mechanism or that vulnerability?

4:31Well then, don't worry, we will cover that in more detail later on in the course. So let's go ahead and dive right into it. I will see you in the next video.

0:00[MUSIC PLAYING] If wireless wasn't introducing a bunch of challenges for us, then we probably wouldn't be sitting here. There probably wouldn't be a CWSP course, and our networks would just be secure on their own. However, wireless not only introduces network challenges just like a wired network does, it introduces additional challenges. And some of that is just the nature of RF waves and how our communications propagate. So in this video, we want to understand some of the fundamental ways that wireless works, and why that introduces vulnerabilities into our networks.

0:35Wireless networks, especially when we talk about Wi-Fi-- Wi-Fi is everywhere these days. I can't go to a hotel or a cafe without them offering Wi-Fi. And that's good. Because I probably wouldn't go to a hotel or a cafe if it didn't offer Wi-Fi. And furthermore, we are seeing the deployment of more and more wireless devices, especially when we consider Internet of Things, or IoT types of devices. These would be smart and connected devices. I know my home is full of them at this point. In the enterprise space, we also see these types of devices get deployed as sensors and trackers.

1:07And so the more of these wireless devices that we have, the more robust of a Wi-Fi environment that we need to build out. The thing is, is that Wi-Fi is all about convenience. And this is a good thing and a bad thing as well. The reason why it's so convenient is because I don't need a wire. I can go anywhere and use the wireless, as long as I have good signal strength. But unfortunately, it's this convenience that opens up a lot of security risks that wouldn't otherwise exist. Now, a lot of these concerns arise simply because of the way that our RF signals propagate.

1:37We need to make sure we have a good fundamental understanding of how RF waves work, because RF waves are exactly how Wi-Fi and all wireless communication ends up functioning. Anytime we talk about a wireless client communicating to an access point or some other wireless device, we typically like to draw this diagram out, and we show that the wireless waves propagate very cleanly, usually in one of these directions-- maybe going from the client up to the AP. But this isn't actually how wireless signal propagates. Instead what we have, is we have the ability to send wireless signals out all around us.

2:11Because the client doesn't actually know where that access point is. And so it has to send it out in all directions. Or maybe we are using some form of directional antenna. But unfortunately for us, that still doesn't create a linear propagation. We might instead see something like this, where it's covering not a 360 area, but still a non-linear direction. And so ultimately, what we have here is that this access point is able to receive my signal. That's good. But so is this client down here. So is this client over here.

2:42So is this client right here in the middle. And probably even a client that's on the other side of the access point, because these signals are going to continue to propagate. And yes, our signal strength is going to weaken the further away from the client that we get. But at the same time, we don't need a particularly strong signal in order to read these wireless waves. So as long as you're in the same general vicinity as this particular transmitter, you can probably make out what exactly it's saying, regardless of where you're sitting. The other thing to consider is the fact that if I do send a wireless signal out from this client, it can actually pass through barriers.

3:17We're familiar with this. I don't have to have an access point in every single one of my rooms. I can put an access point out in the hallway, and the wireless signal will usually pass through pretty well. Yeah, we're going to lose a little bit of energy when we pass through one of these materials. But depending on the material, maybe we lost a lot, or maybe we lost a very little amount. Maybe I only lost 2 decibels by passing through this material, because it's drywall or something along those lines. And as a result, I can communicate just fine to the access point on the other side of the wall. This is very helpful when it comes to making sure Wi-Fi signal is everywhere.

3:51Again, I don't have to have an access point in every room, unless I need one for the sake of capacity or something along those lines. But this can also be a negative. We don't necessarily like this. Because I might have a building-- and this is now a floor plan. So seen from above. And I've got a bunch of access points in here. But if I draw out the signal propagation for each one of these access points, the good news is, yeah, we've got wireless signal everywhere inside the building. But look at all of the wireless signal that's now outside of the building. We have a significant amount of this signal that is leaking out into the parking lot, or possibly into a neighboring space.

4:26Maybe I'm a tenant. I'm leasing a floor in a high rise building or something like that. And so I not only need to worry about this two dimensionally-- meaning, talking about the area around me-- but also maybe three dimensionally. Maybe this is the fourth floor, and I have to worry about bleeding signal down into the third floor or up to the fifth floor. And so this is where we can become concerned about the risks that wireless introduces. Because before wireless existed, if I had a bad actor, let's say, of somebody who's nefariously devising schemes.

5:00They would actually have to get inside my building in order to access my network. And so we had ways of locking down the wired network. We could use port security, for example. But they might try to take a laptop or a device and hardwire it in. Find an RJ45 jack on the wall, plug-in their device. And hopefully, from their perspective, they would then get network access because they would be connected into one of our switches. However, now, we don't even have to do that anymore, because we also have these wireless devices that are sending signals out.

5:32And they no longer have to somehow get inside the building-- they can simply sit inside their car out in the parking lot, and receive these wireless signals. And for that matter, they can send wireless signals back to the access point. Maybe they can try to join the wireless network. Or otherwise, just listen in. I mean, we could have a device here that's trying to talk to this access point. But like we just realized up here, that directional signal is a myth. Because I'm homegating signal like this. And so, yes, the access point is receiving my transmissions, but so would be the bad actor sitting here inside of their car.

6:07This brings up an important topic, which we're going to no doubt spend a lot of time on, which is access control. How do I control who has access to my network? With a wired network, I can do it with these RJ45 port locations. I can make sure they're locked down in a physically secure area. I can also deploy something called port security here, which we'll be talking about. It's a very important concept for securing our wired ports. But how do I stop this person who's sitting in their car out in the parking lot or by the street, from joining my network wirelessly when they can access my wireless devices from all the way out there?

6:44Well, we have a lot of mechanisms for this. I might use something like a password for joining the network. But if the only thing I have protecting my network is a password, then, well, that's the extent of my security. As soon as the bad actor has the password, then they can join my network. So the question is whether they can actually get that password or not. And so there are other options as well. And so we'll absolutely be talking about access control, especially as it relates to the concept of network authentication, which is basically how we log into our networks, whether wired or wireless. But we have another concern that came out of this, that we briefly mentioned in there, which is to do with the concept of data privacy.

7:20We just said that this device right here, which might well be a valid device-- maybe this is one of my users. They're sitting at their desk near a window. They're doing their job. They're communicating with this access point. But again, because of the nature of RF, they're also sending their signals out into the parking lot. And unbeknownst to this user, the bad actor is sitting there listening to everything that they're transmitting. One of the concerns with this type of scenario is that the bad actor doesn't even have to be on my network. I might have done a great job of keeping them off my network using access control, whether that's via password or some other form of authentication, but they don't have access to my network.

7:57And yet, this, my data privacy, remains a concern. If I sent sensitive information to this access point-- maybe I'm sending some kind of important file that includes company secrets, or customer lists, or something along those lines, and I send this file out wirelessly-- well, if I'm not locking down my communications in some form or another, this bad actor can also receive the file themselves. Because again, I'm not sending it in a direction. I'm not sending it directly to this access point. I'm propogating it out everywhere.

8:28Because this client doesn't actually know where the access point is. And so I have to send it out in all directions-- or otherwise explore a directional type of antenna. But typically, clients don't have those. So ultimately, what we have here is a problem around eavesdropping. It's not just bad actors, it's everybody around me. Everybody is going to be able to listen in to my communications. And they're going to, in theory, be able to take my communications and figure out exactly what I was sending. And so this is going to lead to the concept known as encryption.

9:01I need to encrypt, or otherwise scramble my messages in such a way that only my intended recipient, this receiver right here, will be able to unscramble or decrypt. And this is going to have to be bidirectional. I've got a client here communicating with the access point. And so we need to figure out a mechanism for allowing these two devices to communicate privately with one another. And so as we zoom out from this conversation, we see we've got a lot of concerns around wireless networks. So whether it's access control or privacy, or it could be any other number of vulnerabilities, a lot of it has to do with this concept of RF propagation-- and understanding that, if I send my wireless signals out, thinking that I'm sending it to one device, I'm really sending it out to all of the devices in the area.

9:43Now, at the end of these videos, I like to do a quick review of some of the key points. One of the key points of this video is simply that Wi-Fi is everywhere, and the Wi-Fi signals go everywhere as well. They go through walls. They go really, really far. They go in all directions. And this is really helpful when we're building out a wireless network, because we want to make sure everybody has good wireless signal. But it's kind of a double edged sword. Because now, the wireless signal is also going into spaces where I don't have physical control of. And so we might have bad actors, sitting next door or out in the parking lot, that are trying to exploit my wireless network.

10:18Now, wireless networks, as a result of this, we have two main problems we talked about. We need to be able to control access to the wireless network. I need to make sure that, since I can't control where the signals go, that now the people I want to can join my network, but the people I don't want to cannot join my network. The other problem is that we need to implement some form of privacy or encryption. Because if I'm sending signals out-- again, I might think that I'm sending them to the access point up there, but I'm also sending my signals through that wall behind me.

10:49And because I'm sending my signals through that wall, there might be somebody on the other side of that wall that's sitting there listening. And so I need to make sure that I'm using encryption, I'm scrambling my messages, so that they have no idea what I said, but the intended recipient does. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] In the last video, we said that authentication and encryption are going to be two of our primary mechanisms for locking down our wireless networks. So in this video, we're going to talk about those two mechanisms in a little bit more detail to explore how they help us, but also reference a few other protection mechanisms that we'll be addressing throughout this course. Let's talk about some of these concepts. So we mentioned that we need to worry about this access control idea, meaning that I've got an access point here.

0:30Here's a wall. I've got devices that are inside of these walls that are trying to communicate to this access point. And I want them to have access to my network via the access point. This connects back to the local area network. And yet these wireless signals propagate outside of my controlled space. And so what's to stop this device, which belongs to a bad actor, from trying to join the network? Well, the answer is nothing. There's nothing we can do to prevent this person from trying to join the network. But how do we deny their attempt in order to keep my network safe?

1:02Well, one of the mechanisms we can use is authentication. Authentication is basically asking for an identity. It's saying, hey, who are you? This is the focus. Who is this person who's trying to join the network? Now anybody can claim to be anybody. This person who's trying to join the network could claim to be me and say, hey, I'm Jeff, and I'm trying to log into this network. And we know that Jeff is an employee here. So Jeff has access to all of the resources out on the network, and we're trying to get to these resources, whether it's our server applications or maybe it's the data that we're storing.

1:37This is typically what the bad actors are trying to gain access to is something in here because this might be worth money on the black market or the dark web. So they're claiming to be me. So how do we prove whether or not this person is me? Well, this is what authentication is designed to do. We want to issue some form of a challenge to say, OK, you claim to be Jeff. Now, if you are Jeff, you'll be able to complete this challenge. Now, we actually have lots of different challenges that we can issue at this point in time. The most basic of which is what we've used over the course of many, many years, which is the concept of a username and password.

2:13So if I'm right here, and I'm trying to legitimately gain access to the network, well, then I will provide this access point with my username and password. And I need to do it in a secure way so that the bad actors don't just hear my username and password and replicate that after the fact. So if I can securely convey my username and password, then the access point says, OK, you are good to go. You can join the network. Whereas the bad actor can claim that they're me, but they don't have my password. Now the problem with this is simply what if they do have my password? Does just having my username and password mean that they can gain access into the network?

2:47And so maybe we need other mechanisms as well. Maybe we need to think about things such as one-time passwords, something that gets texted to my phone and says, hey, we noticed you're trying to log in to the network. Here's a one time password. If I'm the only one who has access to my phone, I would be the only one who would have it. So even if they have my password, I can use a different form of authentication, what we call two-factor or at some point multifactor authentication depending on how many we're using. Well, I can use this to doubly check and make sure that the person logging in is actually who they say they are.

3:20Now as great as a mechanism as authentication is it's not without its difficulties. For example, how exactly am I going to take this mechanism set and scale it out? Because I might find that I've got hundreds or thousands or tens of thousands of users out there. So how do I make sure that everybody has a secure username and password? And for that matter, how do I manage my different users? If I have a user that gets fired, for example, well, how do I very quickly remove that person's access? Because I might take their laptop, but that doesn't mean they can't walk outside with a different laptop maybe and join the wireless network and start doing some nefarious things at that point.

3:59For that matter, how do I grant temporary access to the network? Maybe this is a guest. Or maybe it's somebody that I'm hiring on for three months. I want to make sure that at the end of their three months that they don't actually continue to have access to my wireless. And for that matter, what happens if we are dealing with some form of compromise? Like we just mentioned, we might have to deal with a situation where a bad actor has managed to get my password. And so how do we detect that they're trying to use this password? And how do I know that it's somebody else who's trying to log in using my password and not me?

4:30So there are lots of options in this space, and we're going to be talking about these throughout the course. Now, the other concern that we talked about in the last video is data privacy. At this point, the bad actor might not even have access to my network, but they can still listen in, or what we like to call eavesdrop on my conversation. And so we need to make sure that we are including some form of encryption. And as we mentioned, the idea here is that I could have a transmitter. And the transmitter is going to send information to a receiver in such a way that only the receiver can understand.

5:02So I'm able to maybe take A, B, C. I want to send A, B, C across this wireless communication. And so I convert it to signals, and it's just all kinds of scrambled information, x!2. And so the bad actor down here sees this information. But then the receiver receives this same information in and is able to decrypt the information back to what I had originally sent. So I know what I sent. The receiver knows what I sent. But the bad actor and anybody else listening in has no idea what I said.

5:36Now, this brings some challenges as well because we understand that there are cracks that are out there and ways to basically counteract encryption. Now in some cases, a crack might actually be breaking the standard. I might be able to, for example, break the WEP standard that we had originally with Wi-Fi. So we had WEP. It was a way to do exactly what we just described. But if you listen into enough WEP traffic, it's pretty easy to actually break it and decrypt the data at that point. But most of our cracks don't actually involve directly breaking the algorithm.

6:11Instead, a lot of cracks have to do with obtaining passwords again. So if I can obtain the right password, if I can obtain the right keys, depending on the situation, if I can get all of these on my own computer, then I can listen into this encrypted traffic. And I can simply decrypt what was sent at that point because I have the keys to be able to decrypt the data. So in order to counteract this, we might have to deploy some secure protocol that can't be broken. And likewise, we also need to make sure that we're protecting our passwords and protecting our keys and deploying mechanisms that can't easily be broken in that way.

6:44Now, authentication and encryption are not the only two mechanisms we'll be discussing from a security perspective. There are quite a few other mechanisms as well. For example, we're going to be talking about protected management frames, or PMF. Management frames are a very important part of the wireless world. An access point is constantly sending these management frames out in a way that as many people as possible can understand them. So sending them at low data rates, which means they go really, really far-- the range is incredible on management frames. And they're often sent in plain text.

7:17And so this means that anybody can listen in, including the bad actor along with all of the other legitimate clients. As a result, this bad actor can learn a lot about what's happening in the wireless network. And furthermore, by the way, the bad actor can actually send out their own spoofed management frames. So if they decide to send out beacons and probe responses saying, hey, guess what? I am an access point as well. So I am an AP, or so they claim. Well, now they could generate a potential man in the middle attack, where we have a client that's trying to decide, do I join this access point or do I join this fake access point?

7:53And if it chooses the fake access point, then the bad actor has access to all of the wireless traffic that this client sends. So we want to protect these management frames. We want to protect them from spoofing. And a mechanism like this is what we would want to deploy in order to accomplish that. Another problem has to do with this joining this fake AP concept where we might want to perform mutual authentication. So now, I'm going to make sure that when I do join you that you've got a certificate that I'm expecting. So if I were to join this access point, the access point can send a certificate, which validates that I am indeed the network that you think you're connecting to.

8:28But if I connect to this fake AP and I'm expecting the certificate, well, the client can't actually send it. They understand maybe that you're expecting one, but I don't have it. And so there's nothing I can do about this, at which point I know that something's wrong here. I'd better disconnect from this wireless network that I found. So a lot of what this comes back to is what we mentioned in the original intro, which is that there's the concept of an attack surface in our networks. We can think of the attack surface as representing the entire area of our network that is susceptible to attacks.

9:02And a very large part of our attack surface might well be the Wi-Fi, making sure that we've got good authentication in place and good privacy in place and that we're locking down some of these other mechanisms. And so as we start to do this, well, we start to make it so that nobody can get through via the Wi-Fi. And, yes, there's all the local area network security situations over here that we might need to worry about. But as far as this course is concerned, we're trying to lock down the surface that is our Wi-Fi network. For example, we might want to deploy VPNs.

9:34We might want to deploy multifactor authentication, as we said, device posturing to make sure that everybody who joins our network has a clean client. They're not bringing viruses onto our network or unpatched operating systems, those kinds of things. And so by deploying all these mechanisms, we can either outright eliminate an attack surface, like I just Drew up here. Or at a minimum, maybe I can reduce it down and make it smaller so I'm less likely to be the victim of a successful attack. So authentication is this process of proving our identity. I can't control where my wireless signals go.

10:06And as a result, I need to make sure that only the people who are allowed onto my network are actually granted access. Now, encryption is going to help me with my data privacy. It's a way that I can scramble my messages and make sure that the person sending and the person receiving, or maybe the client device that's sending and the client device that's receiving, that those two devices are the only ones that can decrypt each other's messages. Now lastly, we talked about this attack surface concept. Ultimately, what we want to do is we want to shrink our attack surface as much as possible, eliminating ways that our network can be compromised, and then where there are places that we know vulnerabilities exist that we provide mechanisms and systems that are going to be in place that will hopefully prevent a successful attack.

10:48I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] When I look at all of the different devices that participate in my wireless network, I realize that there's a lot of this infrastructure that needs to be protected in one way or another. So I need to start thinking outside of just wireless signals and also what types of threats exist when I'm just looking at the different clients that are trying to join my network. Let's take a look. When I think about devices that are joining my network, a lot of them are highly mobile. Yeah, we might have the occasional device that's stuck in place, and it uses Wi-Fi.

0:32But we think about mobile devices typically when we're talking about wireless connections. For example, I've got smartphones. These days it seems like everybody has a smartphone that they're bringing into work and connecting to the network. On top of this, we need to worry about laptops. We need to think about tablets, as well as all the other types of devices that we expect our users to connect to our network so that they can do their jobs. Now, the problem with these mobile devices is that they can get lost. Or worse yet, they can actually get stolen. If they get stolen, at this point we know we have a bad actor of some kind at play.

1:06But maybe it was just a random targeting, or possibly it was somebody who was very intentionally trying to get one of these devices so that they can use it to connect to our network. See, the problem in a lot of cases is that our devices are designed to immediately connect to the wireless as soon as they detect that they're nearby our network. And so if they can compromise the operating system and they can get in using your username and password, or some other mechanism for gaining access, well, at that point, they just have to fire up the device and they can immediately connect to the Wi-Fi.

1:38And so we might want to consider deploying something like multifactor authentication. Because at this point, even if we're connecting into the network, maybe the user, who might not even realize their device has been lost at this point, will get a message on their smartphone, again, assuming that the smartphone isn't the one that was stolen, but ultimately a text message is going to come in with that one time password concept, or simply a question mark of saying, hey, is this you who's trying to access the network? At which point you can say, no, that's not me. And so multifactor authentication can absolutely prevent a situation where simply by grabbing hardware a bad actor could gain access to our sensitive information.

2:15Now, next, we have a related concept, which is what we like to call Bring Your Own Device, or BYOD. BYOD has been a concern in the wireless world for a long time now. And the reality is that a user probably doesn't want to have a smartphone for work and a laptop for work and then also have a smartphone for home and a laptop for home. We would probably rather just get rid of half of these devices and say, OK, I'm going to have these two devices, and it's going to be both for personal use as well as professional or business use.

2:48At this point, I don't have to carry twice as many devices. I can walk in to my house, and I can use my laptop there. And then I can go to my workplace and also use that same laptop. The problem with this is we, in IT, lose control of these devices as soon as we're basically allowing people to bring their own devices into work, because oftentimes these are the personal devices that they're expecting us to allow for them to use on our business, but certainly can go the other way around where we provide them with a laptop or smartphone.

3:19And they take it home or to cafes, and they're doing whatever it is that they normally do on their personal devices on their business devices. So this introduces a whole lot of risks for us. First of all, we can't control where these devices go. This user might show up in a cafe and be on the public Wi-Fi and basically allow for connections to other devices. And they could end up with a virus here. And then they could walk into our business location, so wherever we work. And now they're on our business network, and they have brought that device in with them.

3:52And so now they've introduced the virus onto our network. This could be a major problem and certainly, again, one of the challenges of a BYOD environment. So there are certainly solutions that we can use for this. For example, we could use a Mobile Device Manager, or an MDM, to push down policies that we're enforcing on the devices. So maybe it will make sure that our operating system is patched. Maybe it'll make sure that we've got antivirus running so we didn't accidentally or intentionally disable our antivirus. That could be a big problem. And then ideally we do some form of device posturing for when they want to join our network.

4:26And so we're going to make sure that they are running the latest operating system patch. We're going to make sure that they're running antivirus and possibly make them do an antivirus scan before they gain full access to the network. There's all kinds of options that we have here to try to prevent this BYOD scenario from basically increasing our attack surface to include other networks that we have no control over. Now a big part of pretty much every wireless network these days will be the inclusion of guest access. Guest access can introduce a lot of security holes.

4:57For example, I might be at a cafe. And I log into this access point using the password that has been provided to me, maybe by the cafe staff. But this even though it seems secure because now I'm on the Wi-Fi, I'm using encryption, well, other devices that are listening in, they also know the password. And so they could actually eavesdrop on my encrypted stream because they know the same password that I'm using, effectively, to encrypt that data. This kind of comes back to the BYOD scenario where we might be compromised at a location that is outside of our physical control.

5:30And so this is why we need some of these other mechanisms, like mobile device managers and posturing, to be sure that this type of scenario doesn't result in a compromise of my greater network. But the other factor is what happens when this is my guest network? What happens when I deploy guests? Because ultimately what I have at that point is I have wireless devices that are often communicating with my internal, let's call them, my staff devices, but then also communicating to my guests. Maybe I'm a hospital and I want to service patients and my patient guests by allowing them to join the Wi-Fi and have access to the internet so they can do their video streaming or what have you.

6:10Well, I have a single access point here. And this single access point is connecting to a switching infrastructure, which eventually leads out to the internet in some fashion Meanwhile, hanging off of these switches is also the internal infrastructure. So I've got my applications. I've got my data out here, maybe all my files, my file server. All of this information is hanging off the network. And yet, I've got both of these client types that need to get onto that network for different purposes. So how do I make sure my guest traffic goes straight out to the internet and doesn't allow them to then redirect themselves and get to my sensitive information?

6:48Well, first of all, I'm going to want to make sure that I'm using the proper VLAN configuration along with separate SSIDs to make sure that we are joining two different networks. But then from there, we also need to consider deploying our guests into a DMZ. In fact, we might need to deploy good firewall policy around this, as well as potentially deploying a wireless LAN controller that it belongs inside of the DMZ from a logical configuration perspective. Meaning that my guests will ideally be tunneled to this wireless LAN controller.

7:19And because they are sent in a tunnel to the wireless LAN controller that lives inside the DMZ, well, now my guests are also forwarded into the DMZ directly. And this makes it so that they can't actually go back into the network. Instead, they basically have to go straight out to the internet, which in theory is what a good guest wants anyways. But anybody who is using this for nefarious purposes to try to get to my applications and data, they won't have access to that because of the DMZ configuration. Now sometimes we get so wrapped up in our network security that we neglect to think about physical security.

7:52Attack options actually expand when a bad actor gains physical access to devices. So for example, what happens if somebody goes out into our network and they just grab an access point that's hanging on the wall and they turn around and they take that home? Can they get sensitive information off of this device? And maybe they can and maybe they can't. But we certainly want to make sure that we are locking down our devices and making it so that nobody can just walk out with one of our pieces of equipment. This might mean a physical lock or zip ties or screwing a device down into the wall.

8:26But whatever it is we need to make sure that we're doing our due diligence here to ensure that it's not a simple process for them to walk off with our hardware. We also have a concern where a bad actor might actually take the access point down. And so now the access point is here on the floor. And meanwhile what they're really interested in is the dangling cable because this access point had a cable connected into it. And so now they have an access, in theory, to a network switch. So now they're going to connect their laptop in where the access point was actually connected in.

8:56And this is going to potentially give them direct access to whatever network that access point was a part of. And so we need to make sure that we're also considering port security as part of our physical security process, where security locks down the physical connections that are out there by either completely disabling them, or in the case of an access point, making sure that this device can connect on that port and no other device. In other words, only this device can connect in. So if somebody else shows up on this port, we shut it down.

9:28That's an important part of a security policy, especially as it relates to the physical security world because what we're trying to do here is prevent a bad actor from gaining direct access to the wired network. And our access points might inadvertently provide them a path to do so. So what are some key takeaways as far as how we go about locking down our WLAN infrastructure? Well, part of the infrastructure would be the client. So we see that we've got mobile client devices that could get lost or stolen. We see BYOD devices that might end up bringing a virus or otherwise just bring unpatched devices into our network that could introduce the risk of compromise there.

10:03And so we need to make sure we're like in that down. We've also got to consider how we deploy guest networks. We need to make sure that we're considering how do we separate out our guest network from our internal resources? We never want the two to be able to talk to one another. And so we might end up involving a DMZ or some other configuration that way. Now lastly, we've got to consider physical security. This includes physical access to our switch ports. And that might be a switch port that's just on the wall. Or it might be somebody taking an access point down and plugging into that port because they know that port is active.

10:35And for that matter, we want to try our best to make sure that our access points are secure. Number one, so they can't do that potentially. But also number two, so they can't just grab a piece of hardware, take it home, and see if they can crack the configuration that way. I hope it has been informative for you. And I'd like to thank you for viewing.

0:00[MUSIC PLAYING] As part of this introductory skill, we want to make sure that we understand where security has come from in the world of wireless and also where we are today. In other words, let's talk about that big failure that is known as WEP and what exactly went on there, as well as the progression that we've had going to WPA, WPA2, and at the time of this video, the most modern version, which is WPA3. Let's take a look. Sometimes in order to know where we need to know where we've been.

0:31And where we've been is a pretty dark place in the history of wireless security, and that would be the Wired Equivalent Privacy, or WEP. When 802.11 or Wi-Fi was first released, it included WEP. And the reason for this was well, we saw the writing on the wall, we needed a way to lock down our wireless networks. Now, the curious thing about WEP is that it was authentication and encryption all in one, meaning that we're going to use a single password, and that single password is going to provide both services. Basically, it's going to be used to encrypt the traffic, but also if you don't have the password, then you're not authenticated, meaning if you do have the password, then you are authenticated.

1:10Basically, everything with WEP boiled down to the single password, which is either 40 bits or 104 bits, depending on which version you wanted to deploy. Now, WEP is well known as being a failure. However, it was really a failure for two reasons, even though everyone tends to focus on the first one, which is that it was actually crackable. It wasn't that hard to crack WEP. It was discovered very early that the mechanism that was used in order to encrypt the traffic could be sniffed out. And as a result, we could very quickly start decrypting frames.

1:42Now obviously, if an encryption algorithm can be decrypted by anybody, that is, in itself, a big enough reason to declare it a failure. However, it's still worth understanding that there was a second failure involved because that's something that WPA aimed to fix. And that is that we had no actual authentication here. Now we just said that we do have an authentication mechanism. And so, yeah, we could say that we don't have authentication. We could say that authentication is performed by this password. But the point is that we don't have any way to scale this out.

2:14It's not scalable in any sense of the word, meaning that if I have 1,000 clients out there, yeah, I could put this password on all 1,000 clients. But then let's say that password becomes compromised. And I decide to change the password. Well, I really have to go out and change that password on all 1,000 clients in order to do that. And I have to do it all at once, more or less, and that's going to be a big pain to the point that it's never going to happen, let's be real. And so this was another major failure of WEP, which is why we didn't just patch WEP and move on.

2:44We really needed an entirely new set of mechanisms in order to secure our wireless networks. Now, what was happening behind the scenes is that the IEEE was working on a new specification, 802.11i. This became known as the robust secure network or RSN. The problem is that WEP failed so hard and so fast, that 802.11i just wasn't ready, yet. And so what happened was the industry took a little bit of WEP and they took a little bit of 802.11i and they created Wi-Fi Protected Access, or WPA.

3:17Now the fascinating thing about WPA is it was really just WEP in disguise in a lot of ways. What do we mean by that? Well, basically it's using the same cipher mechanism, which is known as the RC4 cipher with the key difference here being that we got rid of the flaws that made WEP crash and burn. Now, any time we're talking about encryption, what we have is we have a protocol and we have a cipher. And so it's the combination of these two basically, how we use this cipher, that's what the protocol defines, that ends up giving us our mechanisms.

3:48So basically, what we had here was we had WEP as our protocol, and we had RC4 as our cipher, with WEP being all of the ways that we took advantage of that cipher and it was the one that introduced all the flaws. So we cleaned that up. And we called it TKIP. TKIP is really what is weapon disguised because it, ultimately, is the exact same process, but once again, without the flaws. And so we combined this with the exact same cipher. And we called this WPA. And so WPA immediately solved the first issue here, which is that it was crackable.

4:21This has been resolved. And that's a very good thing. We don't want to use an encryption algorithm that can be decrypted by anybody. But it hasn't yet solved our second problem. And this is why it's so important to understand this, which is that we do need a way to have scalable authentication. And so WPA also introduced a new set of concepts to solve this problem, which is known as our personal as well as our enterprise editions of WPA. While WPA personal mode gives us the same mechanism that WEP used, namely this password that's going to show up on all of our devices, Enterprise gave us the scaling that we needed.

4:56And so now this second problem has been solved as well. And we'll talk later on in this course about how exactly it goes about solving that, but this is where we're going to introduce the concept of a RADIUS server, as well is a directory service to basically, allow us to more dynamically add and remove users. Now eventually, 802.11i did get ratified. We have the robust secure network. And this was used to create what became WPA2. So WPA2 comes out. And it is using a new protocol and a new cipher.

5:29It's using CCMP as a protocol. And it's using our advanced encryption standard as our cipher. So we've finally gotten rid of WEP. We've finally gotten rid of TKIP. And now we are using a brand new mechanism, which is hopefully foundationally, a whole lot more secure than WEP and WPA were. In fact, WEP, as well as the original WPA, are both considered deprecated at this point. We should never be deploying them, for sure. And we should never expect to see them in Enterprise networks today. Now that said, WPA2 actually was backward compatible with WEP.

6:01It allowed for running TKIP and RC4 for clients that weren't able to software upgrade to WPA2. Any time we are upgrading technology, we have to worry about legacy clients. Basically what we had was, keep in mind, we had this idea of WEP that was running. And then we had clients that were built for WEP and WEP only. Now when WPA came out, WPA was based on TKIP. And TKIP was basically weapon disguise, meaning from a hardware perspective we were able to migrate these devices over with a simple software upgrade because the hardware was there for performing our TKIP operations.

6:39But now that we have WPA2, and WPA2 is using a different protocol, CCMP, we're not actually able to do a software upgrade of those devices. Instead, we're going to have to get actual new hardware that is able to perform WPA2 with CCMP and AES. This is why WPA2 was made to be backwards compatible because we could have an access point running both of these protocols. And that allows the clients on the left and the clients on the right to both associate, no problem. However, it's highly unlikely in this day and age, that we have any of these clients still running, which is why we can pretty safely disable WPA and TKIP and make sure that we're only running CCMP and WPA2 environments.

7:20Now at this point, WPA has gotten pretty old. In fact, WPA2 lasted for a very long time, but now we do have WPA3 as a fairly recent development in the wireless world. WPA3 is going to use GCMP as our protocol of choice. And we can actually use the same AES that WPA2 had, in other words, our AES with 128 bits of encryption, or we can migrate this and use AES with 192 bits, which is a little bit more secure. It would take a lot more computing processing in order to reverse crack one of these passwords.

7:55Now, WPA3 does some interesting things on the personal side as well. For example, we had a pre-shared key notion for our personal edition of WPA2. However, now we've got a personal edition down here for WPA3. And it doesn't use PSKs. It uses something we call the Simultaneous Authentication of Equals or SAE. And this is going to make it so that dictionary attacks are much harder to perform when we are deploying the personal edition of WPA3. WPA3 also introduces protected management frames, or PMF.

8:27This is what we talked about earlier on in the skill. However, we do have to keep in mind that we have this exact same situation here happening now between WPA2 and WPA3 clients. Namely, that if I have clients here that are able to talk WPA2, that now these clients are not able to talk WPA3 because we lack the hardware in order to speak this new language. And so we might actually have to run both of these protocols in the same space in order to make sure that we're supporting stations that are only WPA2-enabled.

8:59And until we can fully migrate over to WPA3, we're not going to be able to take advantage of certain features, for example, such as protected management frames. Because I can't protect my management frames if not everybody can actually understand what protected management frames are. And so at the time of this video, WPA3 is absolutely the goal for us. We just want to make sure that we are fully supporting WPA2 stations until they have been fully deprecated and are no longer needed to be supported on our networks. So at this point, for most of us who are living in the wireless world, we've probably at least heard that WEP was a failure, if we didn't outright experience it ourselves.

9:36But the key here is recognizing it was a failure, not just because it couldn't encrypt our traffic, but because authentication was not scalable. There really was no authentication other than just the single WEP password. And so WPA came in and it fixed both issues. It introduced TKIP for encryption. It gave us the Enterprise version of authentication, or Enterprise mode we could run in. And just keep in mind, though, that TKIP basically, was that concept of web in disguise. It allowed all of these web devices to just be software upgraded and continue to have now a more secure wireless experience without having to change out the hardware.

10:10And nowadays, we use WPA2 and WPA3. WPA2 introduced a couple of new concepts. We have CCMP and AES. And WPA3 introduces additional security features. We're going to better lock down our mechanisms. We do have some vulnerabilities that are known in the WPA2 implementation, for example, as well as introducing some other important security mechanisms as well. I hope that has been informative for you. And I'd like to thank you for viewing.

0:00[AUDIO LOGO] So here we are at the end of a skill. And a critical part of learning is locking in the knowledge we obtained by doing a quick review. And there's no better way to do a review than to take a quick quiz. So at the end of these skills, you can expect that we will do a quick quiz. This should only take a few minutes. But I do encourage you to pause the question each time and make sure that you can answer it yourself. Because otherwise, we aren't able to identify maybe any weak spots from what we just cover.

0:32So here we are with the first question. It is, why is Wi-Fi more prone to access control and privacy issues than wired networks? Well, it doesn't have anything to do with IPv4 or IPv6. That's at a completely different layer than Wi-Fi operates. That's layer 3. Wi-Fi users don't always have antivirus. That has nothing to do with that. Really, it has to do with our RF waves. And it's not that RF waves are easier to decrypt than electronic or light signals that are in copper, ethernet, fiber, ethernet, those kinds of things.

1:06But rather, it's the fact that our RF waves propagate through the walls, and they go everywhere. Remember, we've got a client here. It wants to talk to the access point. And our wireless waves aren't traveling like this. They're not traveling like this. But rather, they're traveling around in a 360-degree pattern for most of our clients. And so yes, this access point will receive the signal in, so will everyone else in the area. And so D would be our answer here. This is why it is so challenging to lock down our Wi-Fi networks and why something like the CWSP and just in general, wireless security, is so valuable to us in the industry.

1:40Question 2, and there are four questions, by the way. What are two authentication options for access control? When it comes to authentication, remember, we're trying to prove who somebody is. If they're going to log in to the network and say that they're me, for example, how do you prove it? One of the ways you can prove that you are who you say you are is with a password. Maybe I provide my username and password. Another option is to use digital certificates. All of these other options have nothing to do with authentication.

2:11Encryption is its own whole category. It does help for us to log things, but that's not itself going to provide authentication. And locking things down physically is, again, important but it isn't going to help us to authenticate our users. Next question, what must be considered when it comes to Wi-Fi guest security? Anytime we're talking about our Wi-Fi guests, these are users who should not have full permissions to access everything on our internal network. In most cases, we're not too concerned about a guest proving that they are who they say they are.

2:45So we don't need authentication or at least multi-factor authentication. BYOD devices, this is a concern for internal users who are using their own devices from home on our network. So that's not guest-related. Users have to be isolated from our organizational data. That is absolutely the concern here. And lastly, again, physically strapping down our access points is useful, but doesn't have anything to do with our guest access. So we always want to consider how exactly our guests are going to be gaining network access and how we're locking that access down to only grant usually the internet and not access to all of the rest of our assets.

3:19All right. Last question, which wireless security technology was built as a software patch for WEP? By now, we probably all know that WEP was bad news. It did not work, whatsoever. The problem is we had a lot of devices out here that had hardware that was built only to use WEP. And so we could have come up with something like WPA2 that used a completely different protocol, which was CCMP, by the way. But the hardware inside of these devices weren't capable of running CCMP.

3:53Meanwhile, WEP really just had a bad configuration in there. There nothing wrong, strictly speaking, with the cipher we were using, but with the implementation of how we were leveraging it. And so the software patch was created, and that was TKIP. So a would be our answer here. And TKIP was basically, like we said, WEP in disguise. It was going to allow this set of hardware that was designed to run WEP to be able to run TKIP with just a software upgrade. This was instrumental in allowing us to deploy much better security into our wireless space without having to go out and hardware-replace all of the existing components that we had deployed into our networks.

4:31Well, with that, this quiz is done. If any of these questions helped to identify knowledge gaps, then be sure to go back and review the materials in order to make sure that we seal all of those off. Otherwise, congratulations on completing Explain Wireless LAN Security Needs. I hope this has been informative for you, and I'd like to thank you for viewing.