Dummies, Wireless

Chapter 9: Securing Your Wireless Home Network
Going for the Ultimate in Security
Setting up your network with WPA security keeps all but the most determined
and capable crackers out of your network and prevents them from doing
anything with the data you sent across the airwaves (because this data is
securely encrypted and appears to be just gibberish).
But WPA has a weakness, at least the way it’s most often used in the home:
the preshared key (your shared secret or passphrase) that allows users to
connect to your network and that unlocks your WPA encryption.
Your preshared key can be vulnerable in two ways:
� If it’s not sufficiently difficult to guess (perhaps you used the same
word for your passphrase as you used for your network’s ESSID): You
would be shocked by how many people do that! Always try to use a
passphrase that combines letters (upper- and lowercase is best) and
numbers and doesn’t use simple words from the dictionary.
� If you’ve given it to someone to access your network and then they
give it to someone else: For most home users, this isn’t a big deal, but if
you’re providing access to a large number of people (maybe you’ve set
up a hot spot), it’s hard to put the genie back in the bottle when you’ve
given out the passphrase.
802.1x: The corporate solution
Another new standard that’s become quite popular
in the corporate Wi-Fi world is 802.1x. This
isn’t an encryption system but, rather, an authentication
system. An 802.1x system, when built into
an access point, allows users to connect to the
access point and gives them only extremely limited
access (at least initially). In an 802.1x system,
the user could connect to only a single network
port (or service). Specifically, the only traffic the
user could send over the network is your login
information, which is sent to an authentication
server that would exchange information (such as
passwords and encrypted keys) with the user to
establish that he or she was allowed on the network.
After this authentication process has been
satisfactorily completed, the user is given full
access (or partial access, depending on what
policies the authentication server has recorded
for the user) to the network.
177