>> We've talked a little bit about some of
the technology surrounding wireless networks.
Now, we'll talk about wireless security.
We have two main aspects to consider with
wireless security; encryption and authentication.
The very first cryptosystem
that was designed for wireless
was called WEP, Wired Equivalent Privacy.
It's almost as if a salesperson came up with
that name because the name sounds like
it's trying to sell you on the fact that you would get
the same level encryption with
it as you would have with wired networks.
Obviously, that's not the case.
When you have a wired network,
just that physical cable,
as a measure of security that you
don't have with the wireless network.
Other things that were wrong with WEP
were that you had to share authentication passwords,
and it had a weak initialization vector.
Now, we haven't talked about cryptography yet,
but the initialization vector
adds randomness to the process.
The more randomness you
have with the encryption, the better.
But if you don't have a strong initialization vector,
then you get repetitions and patterns.
Another issue with WEP is
that it used an algorithm called RC4.
This particular algorithm is
something called a stream cipher.
Is very fast but easy to break.
We traded off security for speed
>> by using this algorithm.
>> Also, WEP used weak short keys.
You could either operate in one of two modes.
Low encryption mode or 64 bit,
or high encryption mode, 128-bit.
Neither of these, by today's standards, are strong.
But particularly, low encryption mode was very weak.
WEP is not a good choice today.
Another issue with WEP is that it used static keys.
There was no dynamic negotiation of keys.
We knew when WEP came out
that it wasn't where we wanted it to be,
but we also knew we were a long way from having
the technology to truly secure wireless communication.
What we did was put a band-aid on WEP by coming
up with WPA, Wi-Fi Protected Access.
It's an improvement over WEP in a couple of ways.
WPA strengthened the initialization vector
by making it longer.
It also introduced a protocol called TKIP,
Temporal Key Integrity Protocol.
This is a temporary dynamically negotiated key.
The downside is that it still used the RC4 algorithm.
It had to continue using this algorithm
so that it could be backwards compatible with WEP.
Then WPA2 brought two elements
that really improved the security.
The first was AES, Advanced Encryption Standard.
This is a much stronger algorithm than RC4.
I mentioned that RC4 was a stream cipher.
Well, cipher is just another word for algorithm.
An algorithm refers to the
>> math that the encryption uses.
>> RC4 was very fast but easier to break.
AES is slower but much stronger.
Also, WPA2 replaced
TKIP with a new stronger protocol called CCMP.
It has a crazy long name for that acronym,
Counter Mode Cipher Block Chaining
Message Authentication Code Protocol.
Just remember CCMP.
We've got those three modes for encryption.
Then we have authentication.
Now, remember, authentication is proving
your identity or proving you are who you say you are.
Specifically, when you have
remote access devices that
want to join your local area network,
you want to make sure that they are authenticated
and authorized systems joining the network.
There's less security with remote access.
If you have to be physically wired to the network,
then there's security measures that would
prevent or detect an intruder.
But when you're allowing people to connect
via VPN or Wi-Fi,
those physical security measures
don't interfere with an attacker.
You have to make sure that you
have strong technical controls.
What you want is consistency in your policies,
strong authentication,
and strong rules governing
the connection of these devices.
What you do is bring in a
>> device called a RADIUS server.
>> In this diagram, you can see these applicants.
These supplicants are the remote devices
that are trying to access the LAN.
When I say remote,
I mean they're not physically connected to the network.
You might have Wi-Fi clients,
dial-up, or VPN.
Normally, they would connect
>> to a network access device,
>> like an access point or AP for Wi-Fi,
or a remote access server,
or RAS for dial-up,
or a VPN server for VPN clients.
Those applicants initiate the connection
to the wireless LAN.
Traditionally, we would have gone to
each one of these authenticators,
each access point, each RAS,
each VPN, and configure security policies for them.
These policies would say who or
what devices can connect and when they are connected.
It would be really cumbersome to configure
these policies for each authenticator.
Instead, we point
those authenticators to a
>> central authentication service.
>> The most common device that does this is a RADIUS.
RADIUS actually stands for
Remote Authentication Dial End User Service.
The illustration on the left shows these applicants,
the authenticators, and the use of
a RADIUS central authentication service.
The configuration is defined
within the IEEE standard called
802.1x The standard definitely comes up on the test.
I want you to make a couple of
associations to remember it.
When you hear 802.1x, think RADIUS.
Also, think EAPoL,
which stands for Extensible
Authentication Protocol over LAN.
EAP protocol is
a very commonly used protocol for authentication,
and it's very flexible.
Also, remember central authentication for
remote access and associate
that with the 802.1x standard.
A word to the wise.
Wireless technology falls in the 802.11 range.
But remember that RADIUS is 802.1x.
It's not then in wireless standard.
But if you're not paying attention,
you'll mix them up. Really it's separate.
This is for EAP over LAN or EAP over Ethernet.
All that means is, those authenticators are boarding
the EAP requests across the
>> network to the RADIUS server.
>> Be sure to keep those separate
and not mix them up on the test.