3.4 - Given a scenario, install and configure wireless security settings.

Question 1

Cryptographic protocols

Question 2

WiFi Protected Access 2 (WPA2)

Question 3

WiFi Protected Access 3 (WPA3)

Question 4

Counter-mode/CBC-MAC Protocol (CCMP)

Question 5

SAE - Simultaneous Authentication
of Equals

Answer 5

– A Diffie-Hellman derived key exchange with an
authentication component
– Everyone uses a different session key, even with
the same PSK
– An IEEE standard - the dragonfly handshake

Question 6

Authentication protocols

Question 7

EAP

Answer 7

Extensible Authentication Protocol

-auth. framework

-usually used 4 wireless net auth.

-many diff. implementations (EAP-TLS, LEAP, EAP-TTLS)
->each of those protocols implements EAP msgs using protocols msging standards

Question 8

PEAP - Protected Extensible Authentication Protocol

Answer 8

– Protected EAP
– Created by Cisco, Microsoft, and RSA Security

Also encapsulates EAP in a TLS tunnel
– AS uses a digital certificate instead of a PAC
– Client doesn’t use a certificate

User authenticates with MSCHAPv2
– Authenticates to Microsoft’s MS-CHAPv2 databases

User can also authenticate with a GTC
– Generic Token Card, hardware token generator

Question 9

EAP-FAST (EAP Flexible Authentication via Secure Tunneling)

Answer 9

– Authentication server (AS) + supplicant share a
protected access credential (PAC) (shared secret)

-Supplicant receives the PAC

-Supplicant + AS mutually authenticate +
negotiate a Transport Layer Security (TLS) tunnel

-User authentication occurs over the TLS tunnel

-Need a RADIUS server
->Provides auth database +
EAP-FAST services

Question 10

EAP-TLS

Answer 10

-EAP Transport Layer Security
->Strong security, wide adoption
– Support from most of the industry

Requires digital certificates on the AS and all other devices
– AS and supplicant exchange certificates for mutual authentication
– TLS tunnel is then built for the user
authentication process

Relatively complex implementation
– Need a public key infrastructure (PKI)
– Must deploy and manage certificates to
all wireless clients
– Not all devices can support the use of digital certificates

Chapple 435
Weiss 377,379,633
Gibson 120

Question 11

EAP-TTLS (Tunneled Transport Layer Security)

Answer 11

*EAP Tunneled Transport Layer Security
– Support other authentication protocols
in a TLS tunnel

Requires a digital certificate on the AS
– DOES NOT REQUIRE digital certs on every device
– Builds a TLS tunnel using this digital certificate

Use any auth method inside the TLS tunnel
– Other EAPs
– MSCHAPv2
– Anything else

Chapple 435
Weiss 378
Gibson 120

Question 12

IEEE 802.1X

Answer 12

-standard for NAC (net. access ctrl)
-used 4 authentication 4 devices wanting to connect to a net.
-supplicants send authentication reqs. to authenticators (net. switches, access points, wireless controllers)
-controllers connect to authentication server (usually via RADIUS)
-RADIUS servers rely on backend directory using LDAP or AD as source of identity info

Question 13

Remote Authentication Dial-in
User Service (RADIUS) Federation

Answer 13

-Use RADIUS with federation

-common authentication, authorization, accounting (AAA) sys. 4 net. devices, wireless nets, etc.

-can operate via TCP + UDP

-operates in client server model

-sends pswds obfuscated by sharing secret + MD5 hash = pswd sec. not v strong

-traffic btwn RADIUS net. access server + RADIUS server usually encrypted using IPSec tunnels

– Members of one organization can authenticate to
the network of another organization
– Use their normal credentials

-Use 802.1X as the authentication method
->And RADIUS on the backend - EAP to authenticate

Driven by eduroam (education roaming)
– Educators can use their normal authentication
when visiting a different campus https://www.eduroam.org/

Question 14

Pre-shared key (PSK) vs. Enterprise vs. Open

Question 15

WiFi Protected Setup (WPS)

Question 16

Captive portals

Answer 16

*
Authentication to a network - Common on wireless networks
*
Access table recognizes a lack of authentication
– Redirects your web access to a captive portal page
*
Username / password - And additional authentication factors
*
Once proper authentication is provided, the
web session continues
– Until the captive portal removes your access

Question 17

Site surveys

Answer 17

*
Determine existing wireless landscape
– Sample the existing wireless spectrum
*
Identify existing access points
– You may not control all of them
*
Work around existing frequencies
– Layout and plan for interference
*
Plan for ongoing site surveys
– Things will certainly change
*
Heat maps - Identify wireless signal strengths

Question 18

Heat maps

Question 19

WiFi analyzers

Question 20

Channel overlaps

Answer 20

Overlapping channels
– Frequency conflicts - use non-overlapping channels
– Automatic or manual configurations

Question 21

Wireless access point (WAP) placement

Question 22

Controller and access point security

Answer 22

*
Minimal overlap
– Maximize coverage, minimize the number
of access points
*
Avoid interference
– Electronic devices (microwaves)
– Building materials
– Third-party wireless networks
*
Signal control
– Place APs where the users are
– Avoid excessive signal distance