In this lesson,
we're going to cover wireless security setting.
Wireless networks have become a big part of modern life
by providing us with convenient
and flexible access to the internet.
However, these wireless networks can also present
some unique security challenges.
So we need to look at the importance
of using the right wireless security settings,
including the use of WPA3
or other forms of wireless encryption, AAA,
and RADIUS for creating additional layers
of authentication on a network,
and the use of the Extensible Authentication Protocol
known as EAP.
First, let's review some of the most common forms
of wireless encryption, including WEP, WPA, WPA2,
and the most secure form of the wireless encryption, WPA3.
Wireless encryption and cryptographic protocols
are an important part of wireless security
since they provide us with the algorithms that we can use
to encrypt any data being sent over our wireless networks
to ensure that it's unreadable to anyone
who might try to intercept it.
This provides us with confidentiality in our networks.
The first form of wireless encryption was known as WEP.
WEP, also known as Wired Equivalent Privacy
was released in 1999
as part of the original IEEE 802.11 standard,
and it's considered to be an outdated
wireless network security standard
that aimed to provide a wireless local area network
with the equivalent level of security and privacy
when compared against what is usually expected
of a wired local area network.
WEP employs a static encryption key system
where devices on the same network use the same key
to encrypt and decrypt messages.
Wired equivalent privacy encryption keys
come in two main sizes 64-bit and 128-bit.
The 64-bit WEP key is typically 40 bits of actual key data
with an additional 24 bits
of initialization vector added to it.
While the 128-bit WEP key is composed of 104 bits
of key data, again with an additional 24 bits
of initialization vector.
The use of a longer key and the 128-bit WEP
was intended to offer stronger security,
but both have been proven
to be easily compromised with modern techniques.
This system is fundamentally flawed
because with enough data traffic to analyze,
especially with tools to automate this process,
an intruder can often reconstruct the key.
Leading to unauthorized network access.
Furthermore, due to its reliance on the weak
and vulnerable RC4 encryption algorithm, WEP is susceptible
to relatively straightforward cryptographic attacks,
so it is considered to be an insecure option
for wireless security and should no longer be used.
When you hear about WEP, I want you to remember
that it is considered insecure
because of a weak 24-bit initialization vector
that modern laptops can crack in just about three minutes
for almost every WEP-based network.
WEP was then replaced by WPA or Wi-Fi Protected Access
in 2003 as an interim security enhancement over the flawed WEP
while the IEEE 802.11i wireless security center
was being developed.
WPA aimed to correct the pitfalls of WEP
and provide stronger security measures
for wireless networks.
WPA was designed to improve upon WEP's encryption mechanisms
by implementing a temporal key integrity protocol
known as TKIP,
which dynamically generates a new 128-bit key
for each packet,
and thus prevents the key reuse vulnerabilities
associated with WEP.
However, while WPA was a significant step forward,
it still inherited some of WEP's vulnerabilities
due to having being initially designed as a patch
for the existing WEP networks already in use
by enterprises around the world.
Although it was considered to be more secure than WEP
at the time of its release, WPA's own vulnerabilities,
particularly those within the TKIP quickly became apparent,
and this makes WPA susceptible to certain forms
of cryptographic attacks
and emphasizes the need for further advancements
in wireless security protocols.
When you hear about WPA, I want you to remember
that it's considered insecure
because of the lack of sufficient data integrity checks
and the TKIP implementation.
So when the 802.11i standard was introduced in 2004,
a replacement for WPA called WPA2
or Wi-Fi Protected Access 2 was released.
WPA2 brought a new level of data protection
and network access control to wireless networks
by rectifying meaning of the weaknesses observed
in the older and more vulnerable WPA implementation.
While WPA2 replaced WPA's TKIP
with the Advanced Encryption Standard or AES protocol,
and it also began utilizing the CCMP
as a more robust encryption mechanism,
the real name for CCMP is a Counter Cipher Mode
with Block Chaining Message Authentication Code Protocol,
but most people simply refer to it as CCMP
in the real world.
By shifting to WPA2,
we receive not only stronger encryption,
but also new integrity checking feature
called the Message Integrity Code or MIC.
However, despite these advancements,
WPA2 eventually showed vulnerabilities as well,
such as with the KRACK attack in 2016, which demonstrated
that even the most robust security protocols
can become susceptible to threats over time.
And this brings us to our more secure
and most modern implementation of wireless security
and encryption known as WPA3.
WPA3 or Wi-Fi Protected Access 3 is the latest version,
and it continues to use AES for encryption
while adding new features,
including the Simultaneous Authentication of Equals,
Enhanced Open, updated cryptographic protocols,
and the use of management protection frames.
The Simultaneous Authentication of Equals or SAE
provides a new key establishment protocol
to replace the older pre-shared key method using WPA2
to provide us with better protection
against offline dictionary attacks.
The Simultaneous Authentication of Equals
replace the four-way handshake authentication
and association mechanism of WPA with a protocol
that is based on the Diffie-Hellman key agreement.
This means that even if an attacker captures the data
necessary to form the cryptographic handshake in WPA3,
they still cannot use that data to perform an offline attack
to guess the network password.
WPA3 provides several improvements
over the older WPA2 protocol,
including offering more robust protections
even if the user chooses a weak, simple, or short password.
WPA3 also simplifies the process of configuring security
for devices that have limited or no display interfaces.
The second feature added to WPA3 is Enhanced Open.
Enhanced Open, also known as
Opportunistic Wireless Encryption or OWE
presents a significant step forward in wireless security,
particularly for networks
that utilize the open authentication method.
In traditional open Wi-Fi networks,
data is sent over the air unencrypted,
which makes it easier for eavesdroppers
to capture your sensitive information
while it's being transmitted over the network.
Enhanced Open improves upon this
by providing individualized data encryption
between the user device and the Wi-Fi access point,
even where there is no authentication,
such as password protection being required
to join the network.
The Enhanced Open method enhances user privacy and security
since it protects against passive eavesdropping attacks
that are common in public Wi-Fi scenarios.
While it doesn't offer a full-fledged security like WPA3,
Enhanced Open helps to ensure that the connection
between clients and access points are encrypted.
Enhanced Open also provides a more secure connection
than traditional open networks, so it is a valuable feature
for network providers who offer public Wi-Fi services
to their end users.
The third feature we need to cover in WPA3
is the use of updated cryptographic protocols.
In WPA3, the older AES CCMP used in WPA2
is replaced with a newer variant of AES
known as the AES GCMP or Galois Counter Mode protocol.
This protocol not only supports the 128-bit AES algorithm
for your personal networks,
but also supports a 192-bit AES for the use of enterprise
or personal networks with the WPA3 protocol.
The fourth and final feature of WPA3 we need to cover
is the use of management frame protection.
These management protection frames are required
to be used in order to safeguard your network
against key recovery attacks.
This security mechanism ensures the integrity
of network mentoring traffic by preventing eavesdropping,
forging, or tempering with these type of frames,
which are critical for the overall management
and maintenance of wireless communications.
In prior protocols, these frames were transmitted unsecured,
leaving them vulnerable to various forms of cyber attacks,
including the Nile service attacks.
By enforcing their protection,
WPA3 enhances network stability and user security,
ensuring that attackers cannot disrupt the network
by manipulating the traffic essential
for maintaining wireless connections.
This represents another layer of defense,
fortifying the network,
especially in dense complex environments
where such attacks can be very disruptive.
Another important wireless security setting to consider
is the use of AAA protocols like RADIUS or TACACS+.
These protocols are pivotal in managing network security
by facilitating the centralization of user authentication
to ensure that only authorized individuals can access
the network resources.
Implementing such protocols is fundamental
in creating a robust security infrastructure,
especially in environments
where sensitive data is transmitted over networks
and stringent compliance requirements is a must.
RADIUS or the Remote Authentication Dial-In User Service
serves as a networking protocol
that operates on a client server model
that provides comprehensive authentication,
authorization, and accounting services or AAA services
to your network's users.
RADIUS is widely used in an enterprise environment
to enable secure access to your network resources
by authenticating users through a centralized server
that can validate users identities
and grant appropriate access based on predefined policies.
Additionally, RADIUS facilitates the monitoring
of user activity to ensure that accountability
and the enforcement of security policies is occurring.
On the other hand, we have TACACS+
or Terminal Access Controller Access-Control System Plus
is another powerful protocol designed
to provide a similar range of AAA services.
Unlike RADIUS, TACACS+ separates the functions
of authentication, authorization, and accounting
to allow for a more granular control over these processes.
This level of separation permits the distinct handling
of each component across different service.
Also, TACACS+ employs the transmission control protocol
while encrypting the entire authentication process
to enhance its security compared to the older AAA protocols.
The final wireless security settings that we need to cover
are the various authentication protocols
you may come across in the real world.
Authentication protocols are used
to verify the identity of users trying to access a network,
and there are a crucial aspect of network security
that ensures that only authorized individuals
can access the network.
Some examples of authentication protocols include EAP,
PEAP, EAP-TTLS, and EAP-FAST.
EAP or the Extensible Authentication Protocol
is an authentication framework
that supports multiple authentication methods.
EAP provides common functions
and negotiation of authentication protocols
and is used in wireless networks
and point-to-point connections.
While EAP is not a specific protocol by itself,
it is used to define the message formats
and the overall process that will be used
by each specific EAP authentication method.
PEAP or the Protected Extensible Authentication Protocol
is an authentication protocol that encapsulates EAP
within a potentially encrypted
and authenticated transport layer security or TLS tunnel.
PEAP was jointly developed by Cisco Systems,
Microsoft, and RSA Security
as a method to transport authentication data securely
via 802.11 Wi-Fi networks.
EAP-TTLS or Extensible Authentication Protocol
Tunneled Transport Layer Security
is an authentication protocol that extends TLS support
across multiple platforms.
The main difference between PEAP and EAP-TTLS
is that EAP-TTLS requires a certificate
only on the service side,
while PEAP requires dual-sided certificate authentication
to occur on both server and the client side
of the connection.
With EAP-TTLS,
the protocol will encapsulate a second protocol
for authentication that is carried
inside the TLS encryption tunnel.
EAP-FAST, or the Extensible Authentication Protocol
Flexible Authentication via Secure Tunneling
is an authentication protocol developed by Cisco Systems
that allows users to re-authenticate securely
when roaming within a network
without having to perform full authentication
every single time.
EAP-FAST uses protected access credentials
to establish a TLS tunnel
in which client credentials are verified.
EAP-FAST was created as a replacement
for Lightweight EAP called LEAP,
which had several security vulnerabilities
associated with it.
Each of these Extensible Authentication Protocols
has its own strengths and weaknesses,
and the choice between them
depends on the specific requirements of the network
and resources available.
So remember, as wireless networks continue
to expand the popularity, it is important that we learn
the best ways to secure those networks,
including using WPA3 or other forms of wireless encryption,
AAA and RADIUS for creating additional layers
of authentication on the network,
and the use of the Extensible Authentication Protocol
known as EAP.
WPA3 is the latest and most secure version
of the Wi-Fi Protected Access or WPA protocol,
and it is used to provide us
with the most robust protections,
even when users choose passwords that fall short
of typical complexity recommendations.
RADIUS is a networking protocol
that provides centralized authentication, authorization,
and accounting management for users who connect
and use a network service.
While TACACS+ is a separate protocol
that allows for more granular control over authentication,
authorization, and accounting
that offers some advanced security
by encrypting the entire authentication process.
EAP or the Extensible Authentication Protocol
is a universal authentication framework
used to support various authentication methods
such as token cards, smart cards, certificates, and others,
and wireless networks, and point-to-point connections.
By embracing these advanced protocols and methodologies,
we can better empower our wireless networks
with a more secure infrastructure
that is designed to withstand modern threat actors
by ensuring that both user authenticity
and data integrity are protected in our wireless networks.