WLAN Security

1. WLAN Security • Identify and describe the following WLAN security techniques. • SSID Hiding • Legacy Security Mechanisms: WEP and MAC Filtering • User-based Security - 802.1X/EAP and RADIUS Authentication • Passphrase-based Security • Push-button or PIN-based Wireless Security • Encryption – TKIP/CCMP • Role Based Access Control (RBAC) • Virtual Private Networking (VPN) • Wireless Intrusion Prevention Systems (WIPS) • Captive Portal • Regulatory Compliance • PCI Compliance • HIPAA Compliance • Enforcing compliance with WIPS

2. Exam Essentials • Be familiar with 802.11 legacy security solutions • Know the characteristics and features of security mechanisms, including Service Set Identifier (SSID), Media Access Control (MAC) filtering, and Wired Equivalent Privacy (WEP), and the weaknesses or vulnerabilities of each. • Understand passphrase-based security Identify the components of passphrase-based secu­rity that are commonly used for SOHO and home wireless networks. • Identify user-based security components Know the features and use of 802.IX port-based access control, Extensible Authentication Protocol (EAP), and Remote Authentication Dial In User Service (RADIUS).

3. Exam Essentials • Understand Layer 3 wireless security solutions • Know how a virtual private network (VPN) operates as well as the components of the VPN solution. Understand the differences between Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP). • Be familiar with wireless intrusion prevention systems (WIPS) • Know what a WIPS solu­tion is and the benefits it can provide an organization to help manage wireless LAN security. • Understand the purpose of regulatory compliance • Be familiar with regulatory compliances such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Payment Card Industry (PCI) and the important role these play in wireless LAN security.

4. WLAN Security • Early Security • SSID Hiding • MAC Filtering • Wired Equivalent Privacy (WEP) • Newer Solutions (WPA and WPA 2.0) • Preshared Key • Passphrase • User-Based • IEEE 802.1/EAP • RADIUS Pg 338

5. WLAN Security • VPN and Wireless Hotspots • Wireless Intrusion Protection (WIPS) • Regulatory Compliance Pg 338

6. Introduction to Wireless Security • RF broadcasts are easy to intercept • Early deployment security was easy to compromise • Not much enterprise adoption at first Pg 339

7. Wireless LAN Threats and Intrusion • Security depends on • What are you trying to protect? • What are you trying to prevent? • Common Wireless Threats • Eavesdropping • RF Denial of Service • MAC Spoofing • Hijacking • Man-in-the-middle attacks • Peer-to-peer attacks • Encryption Cracking Pg 339

8. IEEE 802.11 Standards Security • Need to provide for Authentication and Privacy • Authentication • Username and password • Login at online bank • Etc. Pg 341

9. Open System Authentication • Two way handshake • Null authentication • Not really authenticating anything • Open Authentication is ONLY used to authenticate a client to an AP, NOT to the wireless network infrastructure Pg 341

10. Shared Key Authentication • This was a WEP Standard • I’d like to be authenticated so that we can exchange data traffic. • No problem. Note: If your data isn’t properly encrypted, it will be dropped. Pg 341

11. Early WLAN Security Mechanisms • Early attempts • SSID Hiding • Easily overcome with wireless protocol analyzers • MAC Filtering • MAC addresses are easily spoofed • WEP • Too easy to crack key, since it never changes • These solutions do not provide enough protection Pg 342

12. Media Access Control (MAC) Address • Limit the clients that can authentication and associate to the WLAN • Build a list of all MAC addresses that are legit • MAC Spoofing • Using software to pretend your MAC is something else • You can see MAC addresses in broadcast frames and then spoof them. Pg 345

13. Authentication and Encryption • Shared-Key • WEP • Open system authentication • Used the encryption • Shared Key • Provided authentication and encryption • NO LONGER CONSIDERED USEFUL Pg 346

14. How to Use WEP • Program same key in all machines • Key is never changed • Easy to crack if you collect enough examples • Payment Card Industry (PCI) compliance states that is anyone who knows the shared key leaves an organization, the shared key must be changed • WEP doesn’t meet compliance after 2010 Pg 346

15. SOHO and Enterprise Security Solutions • 802.11 i standard changed how enterprises used security • Now support more up to date security • To match the RSNA (RSNA) standard, networks must support 802.11i and Temporal Key integrity Protocol (TKIP) • Must change the key periodically • Must support Cipher-block chaining message authentication code protocol (CCMP) Pg 348

16. SOHO and Enterprise Security Solutions CCMP/AES TKIP/RC4 • 128-bit block cipher • Stronger than RC4 (used in WEP and TKIP) • Currently considered uncrackable • Processor intensive • Less protocol overhead than TKIP and more secure • Not available in legacy devices • 128-bit stream cipher • An improvement to WEP • Hasn’t yet been cracked • Most WEP-capable devices can be firmware upgraded to support TKIP • Prevalent in small form-factor Wi-Fi devices Pg 348

17. Wi-Fi Protected Setup certification (WPS) • WPS is designed only for SOHO use. It is not scalable beyond a handful of devices. • Once your WPS-capable devices are powered on, you can enable strong security with the push of a button. • The “button” can be a PHYSICAL button on the outsideof the Wi-Fi router or AP or a SOFTWARE button in the firmware of the Wi-Fi router or AP. Pg 348

18. Wi-Fi Protected Setup certification Pg 348

19. Wi-Fi Protected Setup certification (WPS) • Supports mulitple methods to set up strong security • PIN based • Enter same PIN on all devices • Push Button (PBC) • Literally press a physical button or a button in the client software • Passphrase • Enter the passphrase when prompted Pg 348

20. User-Based Security • 802.1x • Allows administrator to restrict access by creating users in a database • Users use username and password and are granted access based on account permissions • More secure • Usually for enterprise Pg 351

21. 802.1X • Port based access control designed for wired networks • Adapted into wireless as an alternate to 802.11 legacy (SSID Hiding, WEP, etc) • Defined the following • Supplicant (wireless client) • Authenticator (AP) • Authentication Server (AP or RADIUS or other enterprise system) Pg 352

22. EAP • Framework that allows for authentication process • Many types of Extensible Authentication Protocols Pg 353

23. 802.1X/EAP • Basically the AP is configured to point at correct server • Client is configured to request access using that technology Pg 353

24. Remote Authentication Dial In User Service • Networking service that provides an authentication database • Started with Dial-Up • Single server for Modem bank • RADIUS server is authentication Server • Can be on the AP as well • RADIUS Server is also an AAA server • Authentication, authorization and Accounting Pg 353

25. Remote Authentication Dial In User Service WLAN Controller / AP (Authenticator) Knock Knock Who’s There? Wanda Wanda who? Wanda if you are who you say you are? Let’s talk. We don’t have to Wanda anymore. You’re in. No funny business!

26. Encryption: WEP/TKIP/CCMP • Scramble to info so only the intended recipient can read it • WEP • TKIP • CCCMP Pg 356

27. Encryption: WEP/TKIP/CCMP

28. WEP • Supported 64 or 128 bit keys • Too easy to crack regardless • Still used if upgrades have not been done • Better than nothing, but not much Pg 357

29. TKIP • 128-bit stream cipher • An improvement to WEP • Hasn’t yet been cracked • Most WEP-capable devices can be firmware upgraded to support TKIP • Prevalent in small form-factor Wi-Fi devices • Dynamic Re-keying to change encryption and integrity keys • Used RC4 as well, backward compatible with WEP

30. CCMP • Mandatory part of 802.11i and part of WPA 2.0 • 128-bit block cipher • Uses AES • Stronger than RC4 (used in WEP and TKIP) • Currently considered uncrackable • Processor intensive • Less protocol overhead than TKIP and more secure • Not available in legacy devices

31. Encryption: WEP/TKIP/CCMP Pg 360

32. Role-Based Access Control (RBAC) • Similar to standard network administration • Create users and groups Pg 360

33. Role Based Access Control Marketing User = Abbey Normal Group = Marketing Marketing Server only 3 Mbps to Internet Engineering User = Anita Bath Group = Engineering All Servers 200 Mbps to Internet Sales User = Ben Dover Group = Sales Sales Printer only 100 Kbps to Internet Buzzword: RBAC

34. Virtual Private Networking (VPN) • Create Private communications over a public network • VPNs generally are layer 3-IP layer • Often used for remote access • Used in conjunction with public wireless access • Most common protocols are • PPTP • L2TP and IPSec Pg 360

35. PPTP/L2TP • PPTP was developed by Microsoft • Built in to windows server • Easy to implement • Defines tunneling and encryption • L2TP does tunneling • Uses IPSec for encryption Pg 362

36. Components of a VPN Solution • Client Side • Network Infrastructure • Serve Side Pg 363

37. Virtual Private Networking (VPN) Remote Access Point

38. Wireless Intrusion Prevention Systems (WIPS) • Software/Hardware solution to monitor radio waves and report captured info to a database • Watches the captured info for attack signature • Can take countermeasures • Disable or disallow access • Notification of threat Pg 367

39. Wireless Intrusion Prevention Systems (WIPS) • 24/7/365 Monitoring • Detection and Mitigation • Notification of Threats • Integrated Spectrum Analysis • Elaborate reporting systems • Regulatory policy Compliance (HIPAA, PCI) • Retain Data for Forensics • Used Hardware sensors for monitoring Pg 367

40. Regulatory Compliance • Depending on the deployment, you need to be aware of potential issues Pg 369

41. PCI Compliance • For Financial institutions • Build and maintain a secure network • Protect cardholder data • Maintain a vulnerability management program • Implement strong access control passwords • Regularly monitor and test networks • Maintain an information security policy Pg 369

42. HIPAA • Hospitals and healthcare • Goal is standards for exchange of medical data • Security • confidentiality Pg 370

43. Other Regulatory Compliances • Sarbanes Oxley 2002 • Public Accounting Reform and Investor Protection Act • Gramm-Leach-Bliley Financial Services Modernization Act Pg 370

44. Exam Essentials • Be familiar with 802.11 legacy security solutions • Know the characteristics and features of security mechanisms, including Service Set Identifier (SSID), Media Access Control (MAC) filtering, and Wired Equivalent Privacy (WEP), and the weaknesses or vulnerabilities of each. • Understand passphrase-based security Identify the components of passphrase-based secu­rity that are commonly used for SOHO and home wireless networks. • Identify user-based security components Know the features and use of 802.IX port-based access control, Extensible Authentication Protocol (EAP), and Remote Authentication Dial In User Service (RADIUS).

45. Exam Essentials • Understand Layer 3 wireless security solutions • Know how a virtual private network (VPN) operates as well as the components of the VPN solution. Understand the differences between Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP). • Be familiar with wireless intrusion prevention systems (WIPS) • Know what a WIPS solu­tion is and the benefits it can provide an organization to help manage wireless LAN security. • Understand the purpose of regulatory compliance • Be familiar with regulatory compliances such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Payment Card Industry (PCI) and the important role these play in wireless LAN security.