-: Wireless Security. 2 2
In this lesson, 3 3
we're going to discuss the best practices 4 4
for hardening your networks using wireless security. 5 5
We're going to cover topics such as MAC filtering, 6 6
antenna placement, power levels, wireless client isolation, 7 7
guests network isolation, pre-shared keys, 8 8
EAP, geofencing, and captive portals. 9 9
First, let's talk about MAC Filtering. 10 10
MAC filtering allows you to define a list of devices 11 11
and only allow those devices 12 12
to connect to your wireless network. 13 13
Now, it does this by using an explicit allow 14 14
or an implicit allow list. 15 15
With an explicit allow, 16 16
we're going to work by creating a list 17 17
of all the allowed devices 18 18
and blocking any device whose MAC address 19 19
is not included on this list. 20 20
Essentially, it's a white list. 21 21
Now, implicit allow, 22 22
instead works by creating essentially a black list. 23 23
We're going to allow any device 24 24
whose MAC address does not appear in that list 25 25
to connect to our wireless network. 26 26
That's the difference between the explicit allow 27 27
and an implicit allow. 28 28
Explicit allow is a white list, 29 29
implicit allow is a blacklist. 30 30
All right, for best security, 31 31
you should always use explicit allow 32 32
when doing MAC filtering. 33 33
This is because it's really easy to conduct MAC spoofing 34 34
on a wireless device. 35 35
So, if you're using an implicit allow, 36 36
and you're using this blacklist method, 37 37
I can simply take my MAC address 38 38
and spoof it to something else, 39 39
and be on your network within about five seconds. 40 40
So it doesn't really stop a bad actor from getting on there. 41 41
Now, in this case, 42 42
that bad actor looks like they're a brand new user 43 43
and they haven't been a bad person before, 44 44
so you're going to let them connect. 45 45
This is why you always want to use 46 46
an explicit allow instead. 47 47
In theory, MAC filtering is supposed to give you 48 48
some decent protection, 49 49
but I'll tell you, in the real world, 50 50
MAC filtering just isn't that strong, 51 51
and can easily be bypassed. 52 52
So, while maybe a little inconvenient for a skilled attacker 53 53
to get across and get into your network, 54 54
if you're using an explicit allow, 55 55
it really won't slow them down for very long. 56 56
Therefore, if you're going to use MAC filtering, 57 57
don't rely on it as your only protection 58 58
for a wireless network. 59 59
For the exam, though, 60 60
CompTIA does say MAC filtering is a good thing, 61 61
and you should use it. 62 62
Second, Antenna Placement. 63 63
Now, antenna placement is important 64 64
for our wireless networks, 65 65
both for our successful operations of those networks, 66 66
as well as for the security of those wireless networks. 67 67
Most wireless access points 68 68
come pre-installed with an omnidirectional antenna. 69 69
This means the wireless antenna is going to radiate out 70 70
radio frequency waves in all directions at an equal power. 71 71
For this reason, 72 72
you need to carefully consider 73 73
where you want to place that device 74 74
to provide adequate coverage for your entire office, 75 75
but also so that you can keep that signal 76 76
within the walls of your office, 77 77
and not out into the parking lot or other spaces. 78 78
For example, consider this floor plan for a small office. 79 79
Now, where you see a green area, 80 80
we have strong areas of signal strength, 81 81
and the area decreases down to yellow, 82 82
and then eventually down to red. 83 83
Due to the placement of the antennas 84 84
and the wireless access points, 85 85
we actually have some green and yellow signal 86 86
that's actually outside the physical office building. 87 87
Because of this, 88 88
an attacker could be sitting in the parking lot 89 89
and gaining access to this office as wireless network, 90 90
because there's proper coverage in this parking area. 91 91
For this reason, 92 92
it's important to consider the placement of your antennas, 93 93
especially if you're using omnidirectional antennas. 94 94
Additionally, 95 95
you can change out your omnidirectional antennas 96 96
on some access points to use directional antennas instead. 97 97
This will help you keep the signal inside the building. 98 98
So, instead of using four omni-directional 99 99
as they did in this office, 100 100
it would be better from a security standpoint, 101 101
should we play some of those omnidirectional antennas 102 102
with directional antennas. 103 103
For example, on the left-most wall, 104 104
we could mount a right directional antenna 105 105
that would then only broadcast a signal 106 106
180 degrees to the right. 107 107
Meaning there's no radio waves 108 108
leaking out the left wall of that building. 109 109
Similarly, I could use a left directional antenna 110 110
on the right wall, 111 111
pushing the radio frequency ways inward into that building 112 112
all the way to the left, 113 113
but we still need to make sure the omni-directional 114 114
is sitting in the middle. 115 115
This way, we have good coverage for that middle section. 116 116
Now, instead of placing it close to an external wall 117 117
like they did in this diagram, 118 118
I would instead move that more 119 119
towards the middle of the building. 120 120
This will actually center its coverage area 121 121
and keep more of it within the walls of the office. 122 122
In addition to that, 123 123
we could also adjust the power level downward. 124 124
And by doing that, 125 125
keep those radio waves inside the building even more. 126 126
Now, this brings us to our third security measure, 127 127
Power Levels. 128 128
Each wireless access point 129 129
can radiate its radio frequency waves 130 130
at a variable power level. 131 131
If you're using more power, 132 132
you're going to cover more area, but by covering more area, 133 133
we also have radio waves leaving our building, 134 134
and that's not going to be good for security. 135 135
So it becomes important for us to consider 136 136
what power level you're going to be using 137 137
when you set up your wireless access points. 138 138
By conducting a site survey, 139 139
you can determine how much power is too much or not enough, 140 140
and you can balance the needs of network coverage 141 141
against your need for network security. 142 142
Forth, Wireless Client Isolation. 143 143
Now, wireless client isolation is a security feature 144 144
that prevents wireless clients 145 145
from communicating with each other. 146 146
You see, by default, most wireless networks operate 147 147
as if your devices were all connected to a hub, 148 148
and this allows every device to communicate 149 149
with every other device on the wireless network. 150 150
But with wireless client isolation, 151 151
your wireless access point is going to begin to operate 152 152
like a switch when it's using private VLANs. 153 153
Now, this will ensure that each device 154 154
can only communicate with itself 155 155
or upwards to the access point and out of the network 156 156
through the wireless access point. 157 157
By doing this, it operates a lot like a private VLAN 158 158
using an isolation port or I port. 159 159
When using wireless client isolation, 160 160
these devices can communicate with other devices 161 161
on the local area network if the access control lists 162 162
are configured to allow them to do this. 163 163
Now, the fifth thing we want to talk about 164 164
is Guests Network Isolation. 165 165
Guest network isolation is a type of isolation 166 166
that keeps guests 167 167
away from your internal network communications. 168 168
With a guest network isolation, your wireless access point 169 169
will create a new wireless network that's used by guests, 170 170
your home, or your office. 171 171
This wireless network 172 172
simply provides them with a direct path out to the internet 173 173
and bypasses your entire local area network. 174 174
If you have a network device, 175 175
something like a printer or a FileShare, 176 176
the people in the guest network can not get to it 177 177
because they're isolated from your local area network. 178 178
This is a great security measure, 179 179
and ensures your local area network is protected 180 180
from those who are using the guest wireless network. 181 181
Sixth, Pre-Shared Keys, or PSKs. 182 182
Now, pre-shared keys 183 183
are used to secure our wireless networks 184 184
by using encryption, things like WEP, WPA, WPA2, and WPA3. 185 185
The pre-shared key is using these encryption schemes, 186 186
and it's a shared secret 187 187
between the client and the access point, 188 188
and that has to be shared ahead of time 189 189
before you connect to it over some secure channel. 190 190
So, for example, let's say you came over to my house 191 191
and I'm using WPA2 with a pre-shared key. 192 192
Now, you're going to slick my wireless network, 193 193
and then you're going to enter the password for that network. 194 194
That password is your pre-shared key. 195 195
For you to get that pre-shared key, 196 196
I had to give it to you, though, right? 197 197
These pre-shared keys are only as strong 198 198
as the passwords that are representing them. 199 199
So, if you're going to use a pre-shared key, 200 200
make sure you're using a long and strong password. 201 201
The biggest challenge we have with these pre-shared keys, 202 202
though, is that everyone needs to know it, 203 203
to be able to get onto the network, 204 204
so we're all using the same password. 205 205
But having a lot of people using the same pre-shared key, 206 206
it becomes vulnerable to compromise 207 207
because somebody could lose it 208 208
or tell somebody else what it is, 209 209
and then everybody knows what that PSK is. 210 210
Seventh, EAP or the Extensible Authentication Protocol. 211 211
Now, EAP is a protocol that acts as a framework 212 212
and transport for other authentication protocols. 213 213
In our wireless networks, 214 214
if we want to move beyond using a pre-shared key 215 215
for authentication, we can instead use EAP, 216 216
and this is used at a lot of enterprise networks. 217 217
With EAP, 218 218
we can combine it with the 802.1X port access protocol 219 219
to use digital certificates 220 220
and pass them to an authentication server, 221 221
such as a radius or TACACS+ server using EAP. 222 222
Now, this is going to provide us with higher levels of security 223 223
than a pre-shared key, 224 224
and we can individually identify which device or user 225 225
is connected to the network using that digital certificate. 226 226
Eighth, Geofencing. 227 227
Geofencing is a virtual fence 228 228
created within a certain physical location. 229 229
Now, when you combine this with a wireless network, 230 230
we can actually set up our wireless network 231 231
to only allow a user to connect to it 232 232
if they're located within a certain geofenced area. 233 233
For example, let's say I'm running a restaurant in the mall. 234 234
I could set up a wireless network 235 235
to only allow people sitting in my restaurant 236 236
to connect to the wireless network 237 237
and deny anyone whose device says their GPS coordinates 238 238
are not within the four walls of my restaurant. 239 239
So, if somebody's sitting 240 240
at the competitor's restaurant next door, 241 241
they can't use my wireless network. 242 242
Only my clients can, 243 243
because they're sitting within my geofence. 244 244
Nine, Captive Portals. 245 245
Now, a captive portal is a webpage 246 246
that's accessed with a browser 247 247
that's going to be displayed to newly-connected users 248 248
of a wireless network 249 249
before they're granted broader access to network resources. 250 250
If you've ever used the wireless network at a hotel 251 251
or an airplane, you've used a captive portal. 252 252
For example, you connect to your hotel's Wi-Fi 253 253
and a webpage pops up 254 254
and asks you to enter your last name and room number. 255 255
Then, if you enter the details 256 256
and they match your registration from the front desk, 257 257
they're going to let you in to access the internet 258 258
from that network. 259 259
Often, captive portals are going to be used 260 260
to collect billing information 261 261
or consent from a network user, 262 262
but it can also be used 263 263
in combination with network access control, or a NAC system, 264 264
to conduct an agentless scan of the device 265 265
before it allows them to join the full network 266 266
to make sure it meets the minimum security requirements 267 267
for use on that network. 268 268
This is commonly used in colleges 269 269
and universities in this way. 270 270
As you can see, 271 271
there are a lot of different things we can do 272 272
to help secure our wireless networks. 273 273
This includes implementing MAC filtering, 274 274
adjusting your antenna placement, 275 275
lowering your power levels, 276 276
enabling wireless client isolation, 277 277
enabling guests network isolation, 278 278
creating a secure pre-shared key, 279 279
migrating to EAP instead of using a pre-shared key, 280 280
enforcing geofencing, and using captive portals. 281 281
(upbeat music)