Wireless security

The Northfield Community Centre runs two wireless networks: NorthfieldGuest for the public, used by everyone from seniors at the Tuesday computer class to teenagers waiting for basketball, and a staff network for the front desk and the office. Since the evil twin scare described in lesson 4, the centre's manager had asked Brightline to review the whole wireless setup. Keisha sent Jordan with Dev Anand and a checklist. By the end of the visit, the checklist had more crosses than ticks: the staff network used an old security mode, the passphrase had not changed in four years and was written on a sticky note at the front desk, and the guest network let every connected device see every other one.

Wireless networks extend the network through walls and into parking lots, so anyone within range can try to connect or listen. This lesson covers how wireless security developed, the difference between personal and enterprise modes, the threats specific to Wi-Fi, and how to design guest and staff networks for organizations like the community centre and Riverside Family Law.

From WEP to WPA3

The first Wi-Fi security standard, Wired Equivalent Privacy or WEP, was badly flawed and can be broken quickly with free tools; it must never be used. Wi-Fi Protected Access, WPA, was an interim fix using a method called TKIP, and it too is obsolete. WPA2, introduced in 2004, uses AES encryption with a mode called CCMP and was the standard for well over a decade. Its main weakness in personal mode is that an attacker who captures the brief handshake when a device joins can try to guess the passphrase offline, so a weak passphrase can be cracked without the attacker ever being noticed.

WPA3, introduced in 2018, improves on WPA2 in several ways. In personal mode it replaces the old pre-shared key handshake with Simultaneous Authentication of Equals, SAE, which resists offline guessing because each guess requires a live interaction with the network. It also provides forward secrecy, so capturing traffic today and learning the passphrase later does not let an attacker decrypt the old traffic. WPA3 requires protected management frames, which make some disruption attacks harder. WPA3-Enterprise offers an optional 192-bit security mode for sensitive environments. For open networks, Wi-Fi Enhanced Open, based on Opportunistic Wireless Encryption, encrypts each user's traffic even without a password.

Many networks run WPA3 and WPA2 together in a transition mode so that older devices can still connect. This is a practical compromise, but it keeps some WPA2 weaknesses for the devices that use it. Keisha's advice is to use WPA3 only on networks where every device supports it, use transition mode where needed, and plan to retire devices that support only WPA2.

Personal and enterprise modes

Personal mode, also called pre-shared key or PSK mode, uses one passphrase for everyone. It is simple and suits homes and very small offices, but it has serious drawbacks for organizations. Everyone who has ever been told the passphrase can join, including former staff. Changing it means updating every device. And there is no record of which person connected. A long, random passphrase helps against guessing, but it does not fix the sharing problem.

Enterprise mode uses IEEE 802.1X, introduced in lesson 6. Each user or device has its own credentials, such as a username and password or, better, a certificate. The access point passes the authentication to a RADIUS server, which checks the credentials against a directory and tells the access point whether to allow the device and which VLAN to place it in. The exchange uses the Extensible Authentication Protocol, EAP, which comes in several methods. EAP-TLS uses certificates on both sides and is the strongest common choice. PEAP and EAP-TTLS protect a password exchange inside a TLS tunnel. Whatever the method, devices must be configured to check the server's certificate, or an attacker running a fake access point could collect credentials.

Enterprise mode solves the problems of personal mode. A departing employee's account is disabled and they can no longer join. Each connection is logged against a named user. Different users can be placed in different VLANs. For Riverside Family Law, Brightline has proposed WPA3-Enterprise with certificates issued to the firm's laptops and phones, so that only firm-managed devices can join the staff network, and a RADIUS server tied to the firm's directory.

import math
def passphrase_bits(words, list_size):
    return words * math.log2(list_size)
def random_chars_bits(length, alphabet):
    return length * math.log2(alphabet)
print(f"4 random words from 7,776: {passphrase_bits(4, 7776):.1f} bits")
print(f"6 random words from 7,776: {passphrase_bits(6, 7776):.1f} bits")
print(f"10 random characters from 62: {random_chars_bits(10, 62):.1f} bits")
print(f"16 random characters from 62: {random_chars_bits(16, 62):.1f} bits")

4 random words from 7,776: 51.7 bits
6 random words from 7,776: 77.5 bits
10 random characters from 62: 59.5 bits
16 random characters from 62: 95.3 bits

The program estimates the strength of randomly chosen passphrases in bits. Each extra bit doubles the number of guesses an attacker would need. A passphrase of six random words from a list of 7,776 words gives about 77.5 bits, far more than a typical human-chosen password. The estimate applies only if the words or characters are chosen at random; a passphrase based on the centre's name and the year would be much weaker than its length suggests.

Wireless threats

Wireless networks face the general threats from lesson 4 plus some of their own. A rogue access point is an unauthorized access point connected to the organization's network, sometimes installed innocently by a staff member who wanted better coverage, which can bypass the firewall entirely. An evil twin imitates a legitimate network to lure users. Deauthentication attacks send forged management frames that disconnect devices, either to disrupt service or to force devices to reconnect to an evil twin; protected management frames in WPA3 reduce this risk. Jamming floods the radio channel with noise, an availability attack that is hard to prevent but easy to notice.

Eavesdropping is a risk on open networks and on networks with weak security. Devices themselves are a threat too: phones and laptops remember networks they have joined before and may connect automatically to a fake network with a familiar name, such as a common coffee shop name. Wi-Fi Protected Setup, WPS, a feature meant to make joining easy with a button or a PIN, has had serious weaknesses and should be turned off. Hiding the network name and filtering by hardware address are sometimes recommended as security measures, but both are easily bypassed, because network names and hardware addresses can be observed and imitated. They may reduce casual connections but are not real controls.

Wireless intrusion prevention systems, built into many business access points, scan the airwaves for rogue access points, evil twins and attacks, and alert administrators. Regular walk-around surveys with a laptop or phone app can find unexpected networks in smaller sites.

Designing guest networks

A guest network gives visitors internet access without exposing the organization. The guest network should be a separate SSID mapped to a separate VLAN in the guest zone from lesson 6, with firewall rules that allow internet access and deny all internal zones. Client isolation, also called peer-to-peer blocking, stops guests from reaching each other's devices, which matters on a busy public network. A captive portal can show terms of use and, if needed, collect a sign-in or an access code. Bandwidth limits keep one user from swamping the connection. If the guest network has no password at all, Enhanced Open protects visitors' traffic from eavesdropping by other visitors.

Guest passphrases, where they are used, should be changed regularly and should never be the same as the staff passphrase. Signs that advertise the guest network's name help visitors avoid evil twins. At the community centre, Brightline proposed a captive portal with the centre's logo and the exact network name, so that staff can tell visitors "if you do not see our logo, you are on the wrong network".

Securing the infrastructure

Access points and wireless controllers need the same protection as any network device. Change default administrator passwords, manage them over HTTPS or SSH from the management zone, keep firmware updated, and disable unused services. Place access points where they cover the intended area without spilling far outside, and adjust transmit power so that the signal in the parking lot is weaker than in the building. Physical security matters: an access point mounted within reach in a public hall can be unplugged, reset or swapped. Ceiling mounts and locking brackets help.

Coverage and security interact. Too few access points leads staff to install their own, creating rogue access points. Too much power extends the attack surface. A site survey, measuring signal strength across the building, helps get both right. CSCO-112 covers wireless networking from the infrastructure side.

Newer Wi-Fi bands and security

Recent Wi-Fi generations push security forward. Networks in the 6 GHz band, used by Wi-Fi 6E and Wi-Fi 7 equipment, require WPA3 or Enhanced Open; WPA2 is not permitted there. This means that buying new access points is often the easiest way to move a site to WPA3, and that very old client devices will simply not see the newest networks. When Brightline replaces access points for a client, it plans a short period of transition mode on the 2.4 and 5 GHz bands for older devices, then turns transition mode off once the device inventory shows that everything supports WPA3.

Device inventories matter for wireless planning. Label printers, barcode scanners, payment terminals and medical devices often have older wireless chips and may never receive WPA3 updates. Such devices can be placed on a separate SSID and VLAN with tight firewall rules, so that their weaker security does not expose the rest of the network, until they can be replaced.