>> Let's continue our discussion of wireless security.
A lot of times we're concerned with
wireless devices on the network and making sure
that users are authenticated and making
sure that data that's transmitted is encrypted.
A lot of times our focus is on making
sure that the users are the right users.
We don't allow malicious entities on the network.
But what we don't always think about is
how much trust we have in our access points.
I'm used to providing my username and
a password to authenticate to an access point.
But where do I get assurance that
the access point is the legitimate access point?
We have these issues with what I
referred to as rogue access points.
Maybe you're at a Starbucks.
I create an access point with
an SSID of coffee shop Wi-Fi.
If you're not specifically looking for Starbucks or
the Starbucks devices down or if I were closest to you,
my SSID would appear at the top of the list.
Many times people just click on
the first network that makes sense.
You'll see this in airports and hotels.
You need to be very suspicious unless you've been
told the name of the access point and you verified it.
But even if that's the case,
we still have the possibility of
the device being an evil twin.
This is a type of rogue access point that has
the SSID of a legitimate access point.
It's very easy to configure an SSID.
There's no process to make sure there's
no other SSID with the same name.
What will happen is once you connect to a specific SSID,
by default, your network card will connect you
to the same SSID again if it's available.
If I know that the access point for
the Wi-Fi network at your work,
and I create an access point with
the same name and I'm closer to you,
then you are likely to connect to my device.
That's a classic man in the middle attack.
It's so easy to get users to use rogue access points.
Then if that's the case,
none of the other stuff about authentication matters,
because all your data is coming through my system.
We really want to be concerned about
the fact that many times we
can't get assurance that
the access points is the correct one.
What we should have is the use of
certificates in our environment that are going to
allow access points in
DNS servers to authenticate to clients.
Something called NDES or
network device enrollment support is
a protocol that allows devices like
access points to authenticate using certificates.
We really prefer mutual authentication.
I'll authenticate to the access point.
But that access point needs to provide some sort of
certificate to ensure it's correct access point.
But there's a lot of overhead and
time involved in managing certificates.
One of the better methods for mitigating
these risks is to scan the network for your devices.
This involves constantly scanning the network and
knowing the amount of access points that you should have,
and noticing if there are any additional ones added.
It's just about monitoring and staying on
top of these potential security issues.
Let's wrap up this section on wireless security.
We know we have additional challenge of securing
wireless communications than when we have
a network that is connected by cables.
We primarily think about encryption,
where we have our choices of WEP, WPA, and WPA2.
Now we have WPA3.
But it hasn't made it onto the exam yet.
You do not need to worry about that right now.
Under authentication, we think about
centralized authentication under
the IEEE standard 802.1 x,
also known as EAP over LAN,
where we bring in a central authentication server,
like a radius server to provide
a centralized point of authentication and policy.
Then last but not least,
we talked about some common threats.
We talked about rogue access points and evil twins,
which are particularly difficult to detect
because they have the same name
as legitimate access points.
Then NDES.
It's a protocol that allows
devices like access points and
other servers to enroll in
certificates that they can use for authentication.
That's a good mitigation strategy.