Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

68 CHAPTER 4 Wireless Networking
■
Denial of service (DoS) and flooding attacks A DoS occurs when an
attacker has engaged most of the resources a host or network has available,
rendering it unavailable to legitimate users.
PROTECTION AGAINST SPOOFING AND NETWORK HIJACKING
Protecting against these attacks involves adding several additional components to
the wireless network. The following are examples of measures that can be taken:
■ Using an external authentication source such as RADIUS or SecurID, will
prevent an unauthorized user from accessing the wireless network and the
resources with which it connects.
■ Requiring wireless users to use a VPN to access the wired network also
provides a significant stumbling block to an attacker.
■ Allowing only SSH access or SSL-encrypted traffic into the network.
■ Many of WEP’s weaknesses can be mitigated by isolating the wireless network
through a firewall and requiring that wireless clients use a VPN to
access the wired network.
There are several different tools that can be used to protect a network from IP
spoofing with invalid address resolution protocol (ARP) requests. These tools,
such as ArpWatch, notify an administrator when ARP requests are detected,
allowing the administrator to take the appropriate action to determine whether
someone is attempting to hack into the network.
Another option is to statically define the MAC/IP address definitions. This prevents
attackers from being able to IP spoof without having the defined matching
pieces of information. The best protection available is to change the secret key on
a regular basis and add additional authentication mechanisms such as RADIUS
or dynamic firewalls to restrict access to the wired network. However, unless every
wireless workstation is secure, an attacker only needs to go after one of the other
wireless clients to be able to access the resources available to it.
PROTECTION AGAINST MITM THROUGH ROGUE APS
Regular wireless site surveys can be used to see if someone has violated your company
security policy by placing an unauthorized AP on the network, regardless
of their intent. Frequent site surveys also have the advantage of uncovering the
unauthorized APs that company staff members may have set up in their own
work areas, thereby compromising the entire network and completely undoing
the hard work that went into securing the network in the first place. This is usually
done with no malicious intent, but for the convenience of the user, who may
want to be able to connect to the network through his or her laptop in meeting
rooms or break rooms or other areas that don’t have wired outlets.
PROTECTING AGAINST DOS AND FLOODING ATTACKS
There is little that can be done to protect against DoS attacks. In a wireless environment,
an attacker does not have to even be in the same building or neighborhood.