CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

Wireless Security
- Organizations that are not deploying WLANs fast enough often find their employees take the
matter themselves and deploy unauthorized access points and WLANs – rogue access points,
which would create significant security breaches in the network infrastructure.
- Wireless eavesdropping, war driving hacking, and rogue access points (unauthorized access
points that allow unauthorized access to a network) are the main security concerns of WLANs.
- Below lists the 3 categories of wireless network security:
Basic Wireless Security Achieved via SSID, WEP, and MAC address filtering.
Enhanced Wireless Security 802.1X Port-based Network Access Control Authentication
and 802.11i (WPA and WPA2).
Wireless Intrusion Detection Provides detections of rogue access point, unauthorized access,
and intrusions by using access points to scan the RF airwaves
and report the activity in the wireless network.
- All wireless access points are shipped with open access mode and broadcast their identity –
Service Set Identifier (SSID). An SSID identifies the membership with an access point and
eventually a WLAN. All wireless devices that would like to communicate are configured with
the SSID of an access point to establish connectivity to the access point. SSIDs are case sensitive
and should not exceed 32 characters. Joining an open access wireless network (eg: hot spots) by
only knowing its SSID is referred to as open authentication. The reason for shipping open
access products is a common marketing plan to penetrate the networking newbie markets.
Note: Even if SSID broadcasting is turned off, it is possible to discover the SSID by monitoring
the network and wait for a client communicate with the access point. SSIDs are sent in clear text
as regulated in the original 802.11 specification!
- An access point periodically broadcasts its SSID and other network information every few
seconds by default. This action can be stopped in order to prevent a war driving hacker from
discovering the SSID and the WLAN. However, as the SSID is included in wireless beacon
management frames, a sniffing device is able to discover the SSID and eventually the WLAN.
- Wired Equivalent Privacy (WEP) addresses the problem of SSID broadcasts by encrypting the
traffic between wireless clients and access points. When joining a WEP-protected wireless
network, an access point would send a clear-text challenge to the wireless client who must return
it encrypted using the correct WEP key. Once the access point able to decipher the client’s
response, it proves that the client has valid keys and therefore has the rights to join the WLAN.
WEP comes in 2 encryption strengths – 64-bit and 128-bit. Joining a WEP wireless network is
referred to as shared-key authentication. WEP authentication architecture is not scalable due to
the lack of centralized authentication platforms. In contrast, 802.1X-based solutions provide
centralized and scalable security management platforms which can support dynamic per-user,
per-session authentication (and encryption) for wireless connections.
- However, WEP is not considered secure – the challenges and the encrypted responses could be
sniffed and reverse-engineered to deduce the keys used by the wireless clients and access points.
- MAC address filtering can be configured on an access point for the MAC addresses of the
wireless clients that are granted access to a WLAN. However, this approach is also not secure as
wireless data frames could be sniffed to discover and spoof the valid MAC addresses.
182
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com