1
1

00:00:00,510  -->  00:00:02,130
<v ->Wireless Security.</v>
2

2

00:00:02,130  -->  00:00:03,030
In this lesson,
3

3

00:00:03,030  -->  00:00:04,640
we're going to discuss the best practices
4

4

00:00:04,640  -->  00:00:07,270
for hardening your networks using wireless security.
5

5

00:00:07,270  -->  00:00:09,510
We're going to cover topics such as MAC filtering,
6

6

00:00:09,510  -->  00:00:12,950
antenna placement, power levels, wireless client isolation,
7

7

00:00:12,950  -->  00:00:15,430
guests network isolation, pre-shared keys,
8

8

00:00:15,430  -->  00:00:18,340
EAP, geofencing, and captive portals.
9

9

00:00:18,340  -->  00:00:20,900
First, let's talk about MAC Filtering.
10

10

00:00:20,900  -->  00:00:23,360
MAC filtering allows you to define a list of devices
11

11

00:00:23,360  -->  00:00:24,860
and only allow those devices
12

12

00:00:24,860  -->  00:00:26,630
to connect to your wireless network.
13

13

00:00:26,630  -->  00:00:29,000
Now, it does this by using an explicit allow
14

14

00:00:29,000  -->  00:00:30,660
or an implicit allow list.
15

15

00:00:30,660  -->  00:00:32,000
With an explicit allow,
16

16

00:00:32,000  -->  00:00:33,160
we're going to work by creating a list
17

17

00:00:33,160  -->  00:00:34,720
of all the allowed devices
18

18

00:00:34,720  -->  00:00:36,640
and blocking any device whose MAC address
19

19

00:00:36,640  -->  00:00:38,570
is not included on this list.
20

20

00:00:38,570  -->  00:00:40,370
Essentially, it's a white list.
21

21

00:00:40,370  -->  00:00:41,810
Now, implicit allow,
22

22

00:00:41,810  -->  00:00:44,530
instead works by creating essentially a black list.
23

23

00:00:44,530  -->  00:00:45,760
We're going to allow any device
24

24

00:00:45,760  -->  00:00:47,950
whose MAC address does not appear in that list
25

25

00:00:47,950  -->  00:00:49,760
to connect to our wireless network.
26

26

00:00:49,760  -->  00:00:51,810
That's the difference between the explicit allow
27

27

00:00:51,810  -->  00:00:53,140
and an implicit allow.
28

28

00:00:53,140  -->  00:00:55,170
Explicit allow is a white list,
29

29

00:00:55,170  -->  00:00:57,440
implicit allow is a blacklist.
30

30

00:00:57,440  -->  00:00:58,910
All right, for best security,
31

31

00:00:58,910  -->  00:01:01,060
you should always use explicit allow
32

32

00:01:01,060  -->  00:01:02,740
when doing MAC filtering.
33

33

00:01:02,740  -->  00:01:05,560
This is because it's really easy to conduct MAC spoofing
34

34

00:01:05,560  -->  00:01:06,870
on a wireless device.
35

35

00:01:06,870  -->  00:01:08,960
So, if you're using an implicit allow,
36

36

00:01:08,960  -->  00:01:10,830
and you're using this blacklist method,
37

37

00:01:10,830  -->  00:01:12,470
I can simply take my MAC address
38

38

00:01:12,470  -->  00:01:13,960
and spoof it to something else,
39

39

00:01:13,960  -->  00:01:16,920
and be on your network within about five seconds.
40

40

00:01:16,920  -->  00:01:20,070
So it doesn't really stop a bad actor from getting on there.
41

41

00:01:20,070  -->  00:01:21,170
Now, in this case,
42

42

00:01:21,170  -->  00:01:23,490
that bad actor looks like they're a brand new user
43

43

00:01:23,490  -->  00:01:24,980
and they haven't been a bad person before,
44

44

00:01:24,980  -->  00:01:26,310
so you're going to let them connect.
45

45

00:01:26,310  -->  00:01:28,110
This is why you always want to use
46

46

00:01:28,110  -->  00:01:30,380
an explicit allow instead.
47

47

00:01:30,380  -->  00:01:32,520
In theory, MAC filtering is supposed to give you
48

48

00:01:32,520  -->  00:01:34,020
some decent protection,
49

49

00:01:34,020  -->  00:01:35,690
but I'll tell you, in the real world,
50

50

00:01:35,690  -->  00:01:37,690
MAC filtering just isn't that strong,
51

51

00:01:37,690  -->  00:01:39,630
and can easily be bypassed.
52

52

00:01:39,630  -->  00:01:42,610
So, while maybe a little inconvenient for a skilled attacker
53

53

00:01:42,610  -->  00:01:44,460
to get across and get into your network,
54

54

00:01:44,460  -->  00:01:46,390
if you're using an explicit allow,
55

55

00:01:46,390  -->  00:01:49,070
it really won't slow them down for very long.
56

56

00:01:49,070  -->  00:01:51,310
Therefore, if you're going to use MAC filtering,
57

57

00:01:51,310  -->  00:01:53,410
don't rely on it as your only protection
58

58

00:01:53,410  -->  00:01:54,810
for a wireless network.
59

59

00:01:54,810  -->  00:01:56,100
For the exam, though,
60

60

00:01:56,100  -->  00:01:58,660
CompTIA does say MAC filtering is a good thing,
61

61

00:01:58,660  -->  00:02:00,190
and you should use it.
62

62

00:02:00,190  -->  00:02:02,100
Second, Antenna Placement.
63

63

00:02:02,100  -->  00:02:03,700
Now, antenna placement is important
64

64

00:02:03,700  -->  00:02:04,930
for our wireless networks,
65

65

00:02:04,930  -->  00:02:07,340
both for our successful operations of those networks,
66

66

00:02:07,340  -->  00:02:10,060
as well as for the security of those wireless networks.
67

67

00:02:10,060  -->  00:02:11,620
Most wireless access points
68

68

00:02:11,620  -->  00:02:14,410
come pre-installed with an omnidirectional antenna.
69

69

00:02:14,410  -->  00:02:16,860
This means the wireless antenna is going to radiate out
70

70

00:02:16,860  -->  00:02:20,580
radio frequency waves in all directions at an equal power.
71

71

00:02:20,580  -->  00:02:21,660
For this reason,
72

72

00:02:21,660  -->  00:02:22,810
you need to carefully consider
73

73

00:02:22,810  -->  00:02:24,400
where you want to place that device
74

74

00:02:24,400  -->  00:02:26,830
to provide adequate coverage for your entire office,
75

75

00:02:26,830  -->  00:02:28,920
but also so that you can keep that signal
76

76

00:02:28,920  -->  00:02:30,740
within the walls of your office,
77

77

00:02:30,740  -->  00:02:33,630
and not out into the parking lot or other spaces.
78

78

00:02:33,630  -->  00:02:36,860
For example, consider this floor plan for a small office.
79

79

00:02:36,860  -->  00:02:38,430
Now, where you see a green area,
80

80

00:02:38,430  -->  00:02:40,320
we have strong areas of signal strength,
81

81

00:02:40,320  -->  00:02:42,300
and the area decreases down to yellow,
82

82

00:02:42,300  -->  00:02:44,180
and then eventually down to red.
83

83

00:02:44,180  -->  00:02:45,620
Due to the placement of the antennas
84

84

00:02:45,620  -->  00:02:47,130
and the wireless access points,
85

85

00:02:47,130  -->  00:02:49,010
we actually have some green and yellow signal
86

86

00:02:49,010  -->  00:02:51,740
that's actually outside the physical office building.
87

87

00:02:51,740  -->  00:02:52,620
Because of this,
88

88

00:02:52,620  -->  00:02:54,460
an attacker could be sitting in the parking lot
89

89

00:02:54,460  -->  00:02:57,170
and gaining access to this office as wireless network,
90

90

00:02:57,170  -->  00:03:00,010
because there's proper coverage in this parking area.
91

91

00:03:00,010  -->  00:03:01,010
For this reason,
92

92

00:03:01,010  -->  00:03:03,270
it's important to consider the placement of your antennas,
93

93

00:03:03,270  -->  00:03:06,040
especially if you're using omnidirectional antennas.
94

94

00:03:06,040  -->  00:03:06,873
Additionally,
95

95

00:03:06,873  -->  00:03:08,910
you can change out your omnidirectional antennas
96

96

00:03:08,910  -->  00:03:12,580
on some access points to use directional antennas instead.
97

97

00:03:12,580  -->  00:03:15,310
This will help you keep the signal inside the building.
98

98

00:03:15,310  -->  00:03:17,780
So, instead of using four omni-directional
99

99

00:03:17,780  -->  00:03:19,270
as they did in this office,
100

100

00:03:19,270  -->  00:03:21,210
it would be better from a security standpoint,
101

101

00:03:21,210  -->  00:03:23,410
should we play some of those omnidirectional antennas
102

102

00:03:23,410  -->  00:03:25,000
with directional antennas.
103

103

00:03:25,000  -->  00:03:27,280
For example, on the left-most wall,
104

104

00:03:27,280  -->  00:03:29,370
we could mount a right directional antenna
105

105

00:03:29,370  -->  00:03:30,900
that would then only broadcast a signal
106

106

00:03:30,900  -->  00:03:33,040
180 degrees to the right.
107

107

00:03:33,040  -->  00:03:34,710
Meaning there's no radio waves
108

108

00:03:34,710  -->  00:03:37,160
leaking out the left wall of that building.
109

109

00:03:37,160  -->  00:03:39,540
Similarly, I could use a left directional antenna
110

110

00:03:39,540  -->  00:03:40,590
on the right wall,
111

111

00:03:40,590  -->  00:03:43,570
pushing the radio frequency ways inward into that building
112

112

00:03:43,570  -->  00:03:45,010
all the way to the left,
113

113

00:03:45,010  -->  00:03:47,560
but we still need to make sure the omni-directional
114

114

00:03:47,560  -->  00:03:48,820
is sitting in the middle.
115

115

00:03:48,820  -->  00:03:51,910
This way, we have good coverage for that middle section.
116

116

00:03:51,910  -->  00:03:54,060
Now, instead of placing it close to an external wall
117

117

00:03:54,060  -->  00:03:55,620
like they did in this diagram,
118

118

00:03:55,620  -->  00:03:56,790
I would instead move that more
119

119

00:03:56,790  -->  00:03:58,430
towards the middle of the building.
120

120

00:03:58,430  -->  00:04:00,070
This will actually center its coverage area
121

121

00:04:00,070  -->  00:04:03,060
and keep more of it within the walls of the office.
122

122

00:04:03,060  -->  00:04:03,910
In addition to that,
123

123

00:04:03,910  -->  00:04:06,130
we could also adjust the power level downward.
124

124

00:04:06,130  -->  00:04:07,070
And by doing that,
125

125

00:04:07,070  -->  00:04:10,190
keep those radio waves inside the building even more.
126

126

00:04:10,190  -->  00:04:12,670
Now, this brings us to our third security measure,
127

127

00:04:12,670  -->  00:04:13,780
Power Levels.
128

128

00:04:13,780  -->  00:04:14,990
Each wireless access point
129

129

00:04:14,990  -->  00:04:16,890
can radiate its radio frequency waves
130

130

00:04:16,890  -->  00:04:18,560
at a variable power level.
131

131

00:04:18,560  -->  00:04:19,910
If you're using more power,
132

132

00:04:19,910  -->  00:04:23,410
you're going to cover more area, but by covering more area,
133

133

00:04:23,410  -->  00:04:25,720
we also have radio waves leaving our building,
134

134

00:04:25,720  -->  00:04:27,610
and that's not going to be good for security.
135

135

00:04:27,610  -->  00:04:29,600
So it becomes important for us to consider
136

136

00:04:29,600  -->  00:04:31,530
what power level you're going to be using
137

137

00:04:31,530  -->  00:04:33,630
when you set up your wireless access points.
138

138

00:04:33,630  -->  00:04:35,270
By conducting a site survey,
139

139

00:04:35,270  -->  00:04:38,600
you can determine how much power is too much or not enough,
140

140

00:04:38,600  -->  00:04:40,570
and you can balance the needs of network coverage
141

141

00:04:40,570  -->  00:04:42,720
against your need for network security.
142

142

00:04:42,720  -->  00:04:45,300
Forth, Wireless Client Isolation.
143

143

00:04:45,300  -->  00:04:48,130
Now, wireless client isolation is a security feature
144

144

00:04:48,130  -->  00:04:49,360
that prevents wireless clients
145

145

00:04:49,360  -->  00:04:51,140
from communicating with each other.
146

146

00:04:51,140  -->  00:04:54,200
You see, by default, most wireless networks operate
147

147

00:04:54,200  -->  00:04:56,320
as if your devices were all connected to a hub,
148

148

00:04:56,320  -->  00:04:58,300
and this allows every device to communicate
149

149

00:04:58,300  -->  00:05:00,750
with every other device on the wireless network.
150

150

00:05:00,750  -->  00:05:03,040
But with wireless client isolation,
151

151

00:05:03,040  -->  00:05:05,610
your wireless access point is going to begin to operate
152

152

00:05:05,610  -->  00:05:08,290
like a switch when it's using private VLANs.
153

153

00:05:08,290  -->  00:05:10,020
Now, this will ensure that each device
154

154

00:05:10,020  -->  00:05:11,750
can only communicate with itself
155

155

00:05:11,750  -->  00:05:14,840
or upwards to the access point and out of the network
156

156

00:05:14,840  -->  00:05:16,650
through the wireless access point.
157

157

00:05:16,650  -->  00:05:19,410
By doing this, it operates a lot like a private VLAN
158

158

00:05:19,410  -->  00:05:21,750
using an isolation port or I port.
159

159

00:05:21,750  -->  00:05:23,750
When using wireless client isolation,
160

160

00:05:23,750  -->  00:05:25,870
these devices can communicate with other devices
161

161

00:05:25,870  -->  00:05:28,680
on the local area network if the access control lists
162

162

00:05:28,680  -->  00:05:31,090
are configured to allow them to do this.
163

163

00:05:31,090  -->  00:05:32,770
Now, the fifth thing we want to talk about
164

164

00:05:32,770  -->  00:05:34,510
is Guests Network Isolation.
165

165

00:05:34,510  -->  00:05:37,120
Guest network isolation is a type of isolation
166

166

00:05:37,120  -->  00:05:37,980
that keeps guests
167

167

00:05:37,980  -->  00:05:40,390
away from your internal network communications.
168

168

00:05:40,390  -->  00:05:43,110
With a guest network isolation, your wireless access point
169

169

00:05:43,110  -->  00:05:45,840
will create a new wireless network that's used by guests,
170

170

00:05:45,840  -->  00:05:47,540
your home, or your office.
171

171

00:05:47,540  -->  00:05:48,610
This wireless network
172

172

00:05:48,610  -->  00:05:51,350
simply provides them with a direct path out to the internet
173

173

00:05:51,350  -->  00:05:54,230
and bypasses your entire local area network.
174

174

00:05:54,230  -->  00:05:55,510
If you have a network device,
175

175

00:05:55,510  -->  00:05:57,380
something like a printer or a FileShare,
176

176

00:05:57,380  -->  00:05:59,760
the people in the guest network can not get to it
177

177

00:05:59,760  -->  00:06:02,500
because they're isolated from your local area network.
178

178

00:06:02,500  -->  00:06:04,260
This is a great security measure,
179

179

00:06:04,260  -->  00:06:06,340
and ensures your local area network is protected
180

180

00:06:06,340  -->  00:06:09,030
from those who are using the guest wireless network.
181

181

00:06:09,030  -->  00:06:12,020
Sixth, Pre-Shared Keys, or PSKs.
182

182

00:06:12,020  -->  00:06:13,130
Now, pre-shared keys
183

183

00:06:13,130  -->  00:06:15,000
are used to secure our wireless networks
184

184

00:06:15,000  -->  00:06:20,000
by using encryption, things like WEP, WPA, WPA2, and WPA3.
185

185

00:06:21,490  -->  00:06:24,280
The pre-shared key is using these encryption schemes,
186

186

00:06:24,280  -->  00:06:25,520
and it's a shared secret
187

187

00:06:25,520  -->  00:06:27,580
between the client and the access point,
188

188

00:06:27,580  -->  00:06:29,360
and that has to be shared ahead of time
189

189

00:06:29,360  -->  00:06:32,150
before you connect to it over some secure channel.
190

190

00:06:32,150  -->  00:06:34,800
So, for example, let's say you came over to my house
191

191

00:06:34,800  -->  00:06:37,610
and I'm using WPA2 with a pre-shared key.
192

192

00:06:37,610  -->  00:06:39,510
Now, you're going to slick my wireless network,
193

193

00:06:39,510  -->  00:06:41,780
and then you're going to enter the password for that network.
194

194

00:06:41,780  -->  00:06:44,300
That password is your pre-shared key.
195

195

00:06:44,300  -->  00:06:45,710
For you to get that pre-shared key,
196

196

00:06:45,710  -->  00:06:47,500
I had to give it to you, though, right?
197

197

00:06:47,500  -->  00:06:49,400
These pre-shared keys are only as strong
198

198

00:06:49,400  -->  00:06:51,460
as the passwords that are representing them.
199

199

00:06:51,460  -->  00:06:53,790
So, if you're going to use a pre-shared key,
200

200

00:06:53,790  -->  00:06:56,660
make sure you're using a long and strong password.
201

201

00:06:56,660  -->  00:06:58,790
The biggest challenge we have with these pre-shared keys,
202

202

00:06:58,790  -->  00:07:00,740
though, is that everyone needs to know it,
203

203

00:07:00,740  -->  00:07:02,210
to be able to get onto the network,
204

204

00:07:02,210  -->  00:07:04,240
so we're all using the same password.
205

205

00:07:04,240  -->  00:07:06,890
But having a lot of people using the same pre-shared key,
206

206

00:07:06,890  -->  00:07:08,630
it becomes vulnerable to compromise
207

207

00:07:08,630  -->  00:07:09,850
because somebody could lose it
208

208

00:07:09,850  -->  00:07:11,320
or tell somebody else what it is,
209

209

00:07:11,320  -->  00:07:13,970
and then everybody knows what that PSK is.
210

210

00:07:13,970  -->  00:07:18,000
Seventh, EAP or the Extensible Authentication Protocol.
211

211

00:07:18,000  -->  00:07:20,470
Now, EAP is a protocol that acts as a framework
212

212

00:07:20,470  -->  00:07:23,380
and transport for other authentication protocols.
213

213

00:07:23,380  -->  00:07:24,630
In our wireless networks,
214

214

00:07:24,630  -->  00:07:26,610
if we want to move beyond using a pre-shared key
215

215

00:07:26,610  -->  00:07:29,670
for authentication, we can instead use EAP,
216

216

00:07:29,670  -->  00:07:32,000
and this is used at a lot of enterprise networks.
217

217

00:07:32,000  -->  00:07:32,880
With EAP,
218

218

00:07:32,880  -->  00:07:36,230
we can combine it with the 802.1X port access protocol
219

219

00:07:36,230  -->  00:07:37,490
to use digital certificates
220

220

00:07:37,490  -->  00:07:39,520
and pass them to an authentication server,
221

221

00:07:39,520  -->  00:07:43,250
such as a radius or TACACS+ server using EAP.
222

222

00:07:43,250  -->  00:07:45,810
Now, this is going to provide us with higher levels of security
223

223

00:07:45,810  -->  00:07:47,100
than a pre-shared key,
224

224

00:07:47,100  -->  00:07:50,250
and we can individually identify which device or user
225

225

00:07:50,250  -->  00:07:53,690
is connected to the network using that digital certificate.
226

226

00:07:53,690  -->  00:07:55,540
Eighth, Geofencing.
227

227

00:07:55,540  -->  00:07:57,190
Geofencing is a virtual fence
228

228

00:07:57,190  -->  00:07:59,880
created within a certain physical location.
229

229

00:07:59,880  -->  00:08:01,880
Now, when you combine this with a wireless network,
230

230

00:08:01,880  -->  00:08:03,730
we can actually set up our wireless network
231

231

00:08:03,730  -->  00:08:05,670
to only allow a user to connect to it
232

232

00:08:05,670  -->  00:08:08,560
if they're located within a certain geofenced area.
233

233

00:08:08,560  -->  00:08:11,500
For example, let's say I'm running a restaurant in the mall.
234

234

00:08:11,500  -->  00:08:12,870
I could set up a wireless network
235

235

00:08:12,870  -->  00:08:15,100
to only allow people sitting in my restaurant
236

236

00:08:15,100  -->  00:08:16,500
to connect to the wireless network
237

237

00:08:16,500  -->  00:08:19,380
and deny anyone whose device says their GPS coordinates
238

238

00:08:19,380  -->  00:08:21,550
are not within the four walls of my restaurant.
239

239

00:08:21,550  -->  00:08:22,570
So, if somebody's sitting
240

240

00:08:22,570  -->  00:08:24,330
at the competitor's restaurant next door,
241

241

00:08:24,330  -->  00:08:26,250
they can't use my wireless network.
242

242

00:08:26,250  -->  00:08:27,520
Only my clients can,
243

243

00:08:27,520  -->  00:08:29,900
because they're sitting within my geofence.
244

244

00:08:29,900  -->  00:08:31,980
Nine, Captive Portals.
245

245

00:08:31,980  -->  00:08:33,870
Now, a captive portal is a webpage
246

246

00:08:33,870  -->  00:08:35,230
that's accessed with a browser
247

247

00:08:35,230  -->  00:08:37,200
that's going to be displayed to newly-connected users
248

248

00:08:37,200  -->  00:08:38,330
of a wireless network
249

249

00:08:38,330  -->  00:08:41,440
before they're granted broader access to network resources.
250

250

00:08:41,440  -->  00:08:43,230
If you've ever used the wireless network at a hotel
251

251

00:08:43,230  -->  00:08:46,570
or an airplane, you've used a captive portal.
252

252

00:08:46,570  -->  00:08:49,040
For example, you connect to your hotel's Wi-Fi
253

253

00:08:49,040  -->  00:08:50,420
and a webpage pops up
254

254

00:08:50,420  -->  00:08:52,920
and asks you to enter your last name and room number.
255

255

00:08:52,920  -->  00:08:54,420
Then, if you enter the details
256

256

00:08:54,420  -->  00:08:56,570
and they match your registration from the front desk,
257

257

00:08:56,570  -->  00:08:58,640
they're going to let you in to access the internet
258

258

00:08:58,640  -->  00:09:00,060
from that network.
259

259

00:09:00,060  -->  00:09:01,930
Often, captive portals are going to be used
260

260

00:09:01,930  -->  00:09:03,300
to collect billing information
261

261

00:09:03,300  -->  00:09:05,480
or consent from a network user,
262

262

00:09:05,480  -->  00:09:06,670
but it can also be used
263

263

00:09:06,670  -->  00:09:09,920
in combination with network access control, or a NAC system,
264

264

00:09:09,920  -->  00:09:12,180
to conduct an agentless scan of the device
265

265

00:09:12,180  -->  00:09:14,470
before it allows them to join the full network
266

266

00:09:14,470  -->  00:09:16,660
to make sure it meets the minimum security requirements
267

267

00:09:16,660  -->  00:09:18,130
for use on that network.
268

268

00:09:18,130  -->  00:09:19,700
This is commonly used in colleges
269

269

00:09:19,700  -->  00:09:21,530
and universities in this way.
270

270

00:09:21,530  -->  00:09:22,370
As you can see,
271

271

00:09:22,370  -->  00:09:24,050
there are a lot of different things we can do
272

272

00:09:24,050  -->  00:09:26,240
to help secure our wireless networks.
273

273

00:09:26,240  -->  00:09:28,330
This includes implementing MAC filtering,
274

274

00:09:28,330  -->  00:09:29,980
adjusting your antenna placement,
275

275

00:09:29,980  -->  00:09:31,430
lowering your power levels,
276

276

00:09:31,430  -->  00:09:33,440
enabling wireless client isolation,
277

277

00:09:33,440  -->  00:09:35,340
enabling guests network isolation,
278

278

00:09:35,340  -->  00:09:37,380
creating a secure pre-shared key,
279

279

00:09:37,380  -->  00:09:40,470
migrating to EAP instead of using a pre-shared key,
280

280

00:09:40,470  -->  00:09:44,120
enforcing geofencing, and using captive portals.
281

281

00:09:44,120  -->  00:09:46,649
(upbeat music)