In this lesson
we're going to talk about wireless security.
Our wireless networks offer us a lot of convenience,
but they also bring a ton of security risk,
because unlike a wired network,
as long as an attacker's within the footprint
of that wireless signal,
they're going to be able to connect to it
with their smartphone, tablet, or laptop
unless you take some precautions.
To best protect your network,
you need to ensure that your wireless devices
are properly authenticated
when they attempt to connect to your wireless access points,
and that your wireless access points
are securing any data that they're sending or receiving
by properly encrypting that data
as it moves across your wireless network.
Now, when it comes to authentication
in your wireless networks,
we're usually going to rely on two different mechanisms,
a pre-shared key or an enterprise authentication system.
Now, a pre-shared key, also known as A PSK,
is a mode of security authentication
where the same password or key
is being used on both the wireless access point
and any connecting client devices
that are trying to gain access to your network.
This shared key is typically going to be a string of characters
and it's set up in advance,
and then used to establish a secure communication link
between the client devices
and employing encryption to protect the transmitted data
as it goes to and from those client devices
from the access point.
Now, you're probably familiar with a pre-shared key
because if you're watching this video at home,
you probably logged onto your home network
using the same network password
to connect to your home's Wi-Fi
as everyone else in your home,
and that means you're all using a pre-shared key.
Now, unfortunately, there are a few problems
when you're using a pre-shared key
for your authentication mechanisms
when you connect to a given wireless network.
With a pre-shared key,
scalability becomes a big problem for us.
Let's pretend that you work in an office
and there are 50 different employees there
and they all need to be connected
to the company's wireless network.
Well, if you're using a pre-shared key,
every employee is going to be given that secret password
that's going to act as the pre-shared key for that network.
Distributing this securely is going to be one challenge,
and then keeping it secure is going to be yet another challenge
because 50 people know that secret key.
For example, I could go around
and hand each employee a piece of paper
with a pre-shared key written on it,
and then they can use that to connect to our network.
But if we come to work tomorrow
and we had to fire one of our employees,
well now we're going to have to change the pre-shared key
for everyone
because that fired employee
could still access the network
using the pre-shared key
because every employee in the company
knew the pre-shared key that we were using.
Another challenge with pre-shared keys
is that there is no individual user accountability
because every user is using the exact same key.
This makes it challenging
to determine which user on the network
took which action,
because we're not individually logging them onto the network
using a unique username and password.
Now, because of all of this,
using a pre-shared key in a large office environment
is just not going to be practical or effective
most of the time.
So instead,
we're going to have to use
an enterprise authentication mechanism instead
that can offer us the ability
to use individual user credentials
and more robust security protocols.
To do this, we're going to use an 802.1X authentication system
because this is one of the most widely used
enterprise grade authentication methods out there,
and it's going to rely on an authentication server
like a RADIUS
or remote authentication dialing user service server
to manage our user credentials.
When we're using this type of system,
users have to authenticate individually
using their own username and password
or a digital certificate
to uniquely identify them on the network,
and this in turn provides us with better security
and the ability to conduct user tracking.
So, now that we understand the basics
of using a pre-shared key
or using 802.1X for authenticating
to our wireless networks,
let's take a look at the different security
and encryption options
that we can utilize in our wireless networks,
including WEP, WPA, WPA2,
WPA3 and WPS.
First we have WEP.
WEP stands for the Wired Equivalent Privacy,
and it was the original wireless security standard
that was introduced all the way back in 1999
with the very first version of Wi-Fi networks.
WEP claimed that it was as secure as a wired network,
and that's why it was given the name
Wired Equivalent Privacy.
But the truth is, it is not secure,
and these days you should never, ever,
not ever use WEP in your networks,
because it is an extremely insecure protocol.
Now, WEP relies on a pre-shared key,
and this pre-shared key was originally designed
to be a static 40-bit key.
This means it's a very small key size,
and therefore it's going to be pretty easy to brute force
or guess using a modern computer.
Over time, To make WEP more secure,
they increased the key size from 40 bits to 64 bits
and then up to 128 bits,
which is a decent size for a key.
Now, this helps to alleviate
that small key size vulnerability,
but WEP also relies on a weak encryption mechanism
known as RC4
or the Rivest Cipher 4
to encrypt the data being sent and received
over a WEP protected wireless network.
Now, unfortunately, the use of RC4
and that longer 128-bit pre-shared key
didn't really solve
another fundamental challenge within WEP,
which is known as the initialization vector vulnerability.
Now, the way WEP works
is it uses a 24-bit initialization vector,
also known as an IV.
This is just a series of 24 ones and zeros
that's sent in plain text over the network.
Now, if an attacker can capture enough
of these initialization vectors,
they can actually reverse engineer
and crack your encryption key,
and then guess your pre-shared key
that's being used as the password in your WEP network.
In fact, using a software tool like Aircrack-ng,
most attackers can crack a WEP network pre-shared key
in about two to three minutes with a modern laptop.
Second, we have WPA.
Now, WPA or Wi-Fi Protected Access
was designed as a replacement for WEP
because of the initialization vector vulnerability.
To overcome this vulnerability,
the WPA standard
uses TKIP or the Temporal Key Integrity Protocol
instead of using an initialization vector.
Now, TKIP is basically a new type of vector
and it's going to be 48 bits in length,
and it is a double size vector
over the size of the older initialization vector
that was used in WEP.
Unfortunately though,
TKIP is still considered to be very weak
by today's standards,
and it can quickly be cracked using a modern laptop as well.
Now, WPA also relies on the same RC4 encryption
like WEP did,
but it does add a few other key features to it.
For example, WPA added some integrity checking
to its data transfer
to help prevent an on-path attack
from being successfully conducted
against your wireless networks
by using something known as the message integrity check.
The Message Integrity Check or MIC
relies on hashing the data
before it's being sent over the network,
and that way the receiver can verify
it wasn't modified as the data moved throughout the network.
WPA also introduced a new function called enterprise mode
for authenticating client devices.
This WPA enterprise mode
provides clients with individual authentication
of their devices
using a unique username and password
through an authentication server
like a RADIUS server,
as well as using stronger encryption methods
and security protocols
and providing us with better scalability
and centralized key management
then could be achieved by using a pre-shared key.
Ultimately though,
WPA was determined to be vulnerable to attack,
and it was replaced with a newer version
known as WPA2 or Wi-Fi Protected Access 2.
Now, WPA2 was introduced back in 2004,
and it's still heavily used today.
WPA2 was created as part of the 802.11i standard,
and it was first implemented with wireless G
and then used again with wireless N,
wireless A and wireless AC networks.
WPA2 provides us with the ability
to have stronger integrity checking,
better encryption
and improved authentication
over our earlier WPA based systems.
Now, instead of using the Message Integrity Check or MIC,
WPA2 relies on something known as Counter Mode
with Cipher Block Chaining
Message Authentication Code Protocol,
which most people refer to simply as CCMP.
Now, with CCMP,
the functions from the message integrity check
are already included,
but it also added a comprehensive encryption protocol
to provide confidentiality and integrity assurance
in your wireless systems.
Another improvement in WPA2 over WPA
is that it was replacing the older and less secure
RC4 encryption algorithm
that was used in WEP and WPA
with a newer and more secure one
known as the Advanced Encryption Standard or AES.
Now, AES uses a 128-bit key,
a 192-bit key
or a 256-bit key
depending on your access point's implementation.
With most WPA2 networks, it's going to use a 128-bit key.
Now, AES does provide us with more security
and confidentiality for our data
as it's being transmitted over our wireless networks
than did the old RC4 encryption algorithm.
In WPA2,
the system can be configured to support
authentication of your clients
using either a personal mode or an enterprise mode.
In personal mode, WPA2 utilizes a pre-shared key,
and this is what most people use in their home
or small office networks.
But, if you're using WPA2 in a large office environment,
you're probably going to be using WPA2 enterprise mode instead.
Because this relies on individual usernames and passwords
or digital certificates,
they're going to be evaluated
by a centralized authentication server
before granting the client device
access to your wireless network.
Now in 2018,
the latest version of WPA,
known as Wi-Fi Protected Access 3 or WPA3
was introduced to the world.
WPA3 improves upon WPA2
with features like SAE
or the Simultaneous Authentication of Equals
for personal networks
and an increased encryption strength
for enterprise networks
by supporting AES in Galois Counter Mode,
known as GCM,
and by allowing the use of larger 192-bit
and 256-bit encryption keys to secure your data
when encrypting that data using the AES GCM algorithm.
The Simultaneous Authentication of Equals, or SAE,
is a security protocol
that was designed to enhance the handshake process
used in Wi-Fi authentication.
Now, SAE replaces a pre-shared key method
that was used in WEP, WPA and WPA2
with a more secure authentication mechanism.
This protocol is going to be based on
the Dragonfly key exchange method,
and it has been found to be resilient
against offline dictionary attacks,
which were a significant vulnerability
in the older WPA2 pre-shared key model.
Now, the primary advantage of using SAE inside of WPA3
is in its improved approach
to establishing a secure initial key exchange
between the client and the access point.
Now, unlike WPA2
where an attacker could intercept the handshake process
using an on-path attack
and then use it to guess the network password
with multiple offline attempts,
SAE's method ensures that each attempt to guess the password
requires an active interaction with the access point itself.
This interaction significantly slows down the attacker
and effectively makes a brute force attack
impractical for them to complete.
SAE does offer forward secrecy,
which means that if a session key is compromised,
then its past communications
will still remain securely encrypted and protected.
This enhancement in the authentication process
improves our Wi-Fi network security
and makes WPA3 networks
much more resistant to password related attacks
than any of the older wireless security standards
that we've covered so far.
The final wireless security technology
we need to briefly cover
is what's known as Wi-Fi Protected Setup or WPS.
Now, WPS isn't an encryption or integrity protocol
like WEP, WPA, WPA2 or WPA3,
but instead it's a network security standard
that's aimed at simplifying the setup
of a secure Wi-Fi connection.
WPS allows your users to connect to a network using a PIN,
and this can be hard coded into your device,
be set up with a push button
or Near Field Communication as one of its mechanisms.
Most often though,
I have found that WPS
is implemented using a push button
on the front of your wireless access point.
Now, WPS was designed
to make it easier for non-technical users
to set up secure networks
without the need to manually enter long passwords
to be able to configure and use WPA
or WPA2-based encryption systems.
The idea here was that
this would promote the use of longer, stronger,
and complex passwords
when you initially configure your wireless network,
because the user doesn't have to actually type it in
each and every time it wants to configure a client.
Instead, the user could simply push the WPS button
on their wireless access point
and then configure their client
to connect to the access point using that WPS standard,
and it will automatically be provided with
that long, strong and complex password
after they provide a simple eight digit PIN.
Now, the real problem with WPS though
is a significant vulnerability in the PIN itself
that makes it vulnerable to a brute force attack.
Basically, the way WPS was designed,
even though the PIN is eight digits long
and should have 100 million possible eight digit numbers
that we would need to try,
the system was actually designed
to break that eight digit number into two halves
and then check each half,
which is only four digits
against the stored PIN in the wireless access point.
By doing this,
the key size is effectively reduced
from eight digits down to four digits plus four digits,
which mathematically reduces the total possible combinations
from 100 million down to 20,000 options,
which makes it very quick and easy
to brute force on a modern laptop.
Now, due to this vulnerability,
it is recommended that you disable the use of WPS
in your wireless networks,
especially if you need to maintain
high levels of data security inside of those networks.
So remember, when it comes to wireless security,
you should always use the most secure option
that your devices are going to be able to support.
For most of us, this is going to be WPA3,
but if you have some legacy equipment
that still needs to be supported,
you can still safely use WPA2 in most cases.
These days, you should never use WEP,
WPA or WPS in your networks
because they're all simply too easy to crack
using a modern laptop and some open source software
that an attacker can use
to determine your network's password
in just a few minutes or so.
Now, for the exam,
I want you to remember a few key things
about wireless security.
First, anytime you see the word open
in reference to a wireless network,
this means there is no security,
no protection, and no password.
Open simply means they've chosen no encryption scheme,
so they're not even using WEP or WPA or WPA2 or WPA3.
None of those being used in an open network.
Second, anytime you see the word WEP,
I want you to associate this with initialization vectors,
because that's the vulnerability inside of WEP,
that makes it weak and bad for you to use in your networks.
Third, anytime you see the word WPA,
I want you to think about TKIP and RC4
because TKIP was what we used
to replace the initialization vectors
and RC4 was its form of encryption
that was used in both WPA and WEP.
Fourth, anytime you see the word WPA2,
I want you to think about the acronyms of CCMP and AES.
Now, CCMP is the integrity protocol we use,
and AES is the encryption mechanism that we use
inside of WPA2.
Fifth.
Anytime you see the word WPA3,
I want you to think about
the simultaneous authentication of equals
or SAE
and the Dragonfly key exchange.
Sixth, anytime you see the word WPS,
I want you to think about that push button configuration
that's using an eight digit PIN,
and this is something you should disable
inside of your wireless networks.
Seventh, anytime you hear the term pre-shared key,
you should be thinking about a password being used
in a personal mode of your wireless network.
And eighth and finally,
anytime you hear enterprise mode,
you should be thinking about using
an individual username and password
for each of your users
and authenticating them
using a centralized authentication server
like a RADIUS server
that uses the 802.1X authentication protocol.
If you keep these tips and tricks in mind,
you should do well on the wireless security questions
come exam day.