- Now in this lesson, 14.2
we're going to really focus in on wireless configuration.
And then in the next lesson, 14.3,
we're gonna continue the discussion about wireless.
Now, we talk about wireless configuration
or wireless networking,
what we're talking about is the connectivity
through radio frequency transmissions.
Now, wireless configuration modes include an ad hoc mode
which is a wireless peer-to-peer relationship
and infrastructure mode topology, what we often refer to
as our wireless network, which includes
wireless devices access points, and wired routers.
So let's go through
some different wireless network configurations.
We've got a WPAN that's a wireless personal area network.
You and I know it as Bluetooth, right?
We use it to connect devices in close range like our mice
and our keyboard, or maybe our earbuds or speakers.
It uses the 802.15 IEEE standard.
Then we have a WLAN that's a wireless local area network
which uses an 802 IEEE standard.
And we're gonna be talking more
about that standard in just a moment.
Then we have a WMAN,
which is a wireless metropolitan area network
which uses the 802.16 IEEE standard.
And lastly, we have MBWA,
which is a mobile broadband wireless access
which uses the 802.20 IEEE standard.
But we're gonna really be focusing in on a WLAN.
So let's look at this 802.11 IEEE standards.
First, let me tell you,
you don't have to memorize this table.
But what I want you to know is the difference
between the first one, two, three, four,
five specifications there
is data rate, frequency, and distance.
So looking at 802.11,
which was the original 802.11 standards
or specification, our data rate
for transfer was two megabits per second,
our frequency was on the 2.4 gigahertz channel
and our distance only went a hundred meters.
But go all the way down to n, right?
And now we're at a data rate of 150 megabits per second.
We can go on two different channels, so dual band,
2.4 or five gigahertz, and we can go up to 250 meters.
Now that doesn't mean you necessarily have
to put in you know, n.
Maybe g is appropriate for you.
So you're gonna make decisions
based on configuration and probably on cost.
So just know that in those basic specifications, right?
The difference is data rate, frequency and distance.
Now, 802.11i is all about security for 802.11 technologies.
And for our purposes,
we're gonna divide them into two buckets.
A legacy bucket where web and WPA live,
and a current bucket where WPA2 and WPA3 live.
And then 802.11 E specification is all about QoS.
It's quality of service
for priority and for time sensitive data.
So let's talk about 802.11i legacy security.
That's where we find WEP, wireless equivalent privacy
and WPA, Wi-Fi protected access.
So starting with WEP, WEP used a pre-shared key.
So everybody used the same key
and all services used the same key
or more than likely it was just wide open.
The key was a shared 64 or 128-bit key.
It used an RC4 stream cipher, and it has been broken
so it is without a doubt insecure.
So there was a temporary fix
by the Wi-Fi Alliance that came out with WPA,
which is Wi-Fi protected access.
Really changed how we do authentication, right?
Authentication now could instead of just a wide open
or a pre-shared key that everybody was using.
We could use an enterprise RADIUS for authentication.
We could use a certificate for authentication
or we could use a personal pre-shared key, a PPSK.
We had separate 256-bit keys
still using an RC4 stream cipher
but it really was just a temporary fix.
And fairly quickly it was superseded by WPA2.
But oddly, when you go to configure a wireless network
and you do a dropdown,
you're still sometimes gonna see WEP and WPA in the list.
So I just mentioned that with WPA,
we had the introduction of a RADIUS server.
So let's pause for a moment
and talk about what a RADIUS server is.
A RADIUS server which stands
for remote authentication dial-in user service
provides centralized authentication,
authorization, and accounting services.
So it's often referred to as AAA
for remote access and for network clients.
Now, RADIUS servers act as an authentication device.
Once the user is authenticated,
the RADIUS server can determine access privileges
that would be the authorization.
And the RADIUS server can keep track of network usage
and can generate records related to the user session.
And that's referred to as accounting.
Now, the other option that was introduced was a PPSK.
That's a personal pre-shared key.
A personal pre-shared key is a security mechanism
that we use in our wireless networks to authenticate
and authorize client devices.
Now, the PPSK is a unique passade or key shared
between the wireless access point or the Wi-Fi router
and the client device that wants to connect.
Now, although PPSK is shared among multiple devices,
each device is actually uniquely identified
by its MAC address.
Now let's fast forward to current 802.11i security.
We've got WPA2 and WPA3,
which are both considered current versions.
For authentication, WPA2 will use
in enterprise RADIUS, we just talked about that.
Could use a certificate or a personal pre-shared key.
We just talked about that.
It does use separate 128-bit keys.
And now the encryption has moved
from a stream cipher to a block cipher.
And from RC4 to AES,
which is a current US government standard
for symmetric encryption.
It is our current standard, it is considered secure.
There is a known vulnerability however.
If you're using in conjunction
with Wi-Fi protected setup or WPS,
that's where you can connect.
If you're just in close proximity to the router,
you can just click a button and you'll connect.
There is a flaw there
that potentially would allow the WPA key to be captured.
Now, WPA3, which came out a couple years ago
but has optional certification now
and is backward compatible
with WPA2 really changed up the game.
We moved from this enterprise RADIUS certificate
or personal pre-shared key to what's known as enterprise
or personal simultaneous authentication of equals or SAE.
So a totally different way of doing this.
Sometimes, that's referred to
as the dragonfly authentication.
We have separate 256-bit or 384-bit keys.
So 384 in enterprise, 256 in personal,
still using an AES block cipher.
The type of block we're using is a GCMP-256 mode.
So really enhancing the security there.
And we're using an HMAC,
remember we put a symmetric key in
with the information that's going through
the hashing process using SHA384.
So really, really locked down, really secure.
Again, optional certification right now,
it is backward compatible with WPA2.
So let's dive in a little deeper
about what do we mean
about the simultaneous authentication of equals.
Simultaneous authentication of equals or SAE,
again, also known as dragonfly authentication and encryption
is a secure password-based authentication
and password authenticated key agreement method.
Sounds pretty complicated.
So WPA3 uses SAE to replace WPA2's
personal pre-shared key exchange protocol.
So SAE incorporates secure mutual authentication
and SAE employs perfect forward secrecy
and is resistant to offline decryption attacks.
There's a lot of benefits from moving to WPA3.
In particular, perfect forward secrecy.
So what's perfect forward secrecy?
Perfect forward secrecy is a protocol property
that effectively protects past sessions
against future compromises.
A new session key is generated for each session.
And even if an attacker gains access to the private key,
the past communication sessions can't be decrypted
since those sessions were encrypted
using different session keys.
That transport layer security
and internet key exchange, or IKE, which is part of IPSec
can be configured to provide forward secrecy
by generating ephemeral
or unique session keys for each session.
So that's our overview of wireless security.
And in the next lesson, we're gonna dive a little bit deeper
into wireless configurations.
But before we do that, let's do a three-second challenge.
Challenge one.
Common name for the 802.15 standard.
You know this one.
Starts the letter B.
One, two, three.
That's gonna be Bluetooth.
Number two.
Primary and time sensitive data configuration.
There's an 802.11 specification specifically for this.
One, two, three.
And that's gonna be QoS or quality of service.
Number three.
The authentication method used in WPA3.
One, two, three.
That's gonna be simultaneous authentication
of equals or SAE, also known as dragonfly.
Number four, device that can provide authentication
authorization, and accounting services.
AAA, notice I'll start with A.
Authentication, authorization and accounting services.
Give me a device that can do all of those.
One, two, three.
And that's gonna be RADIUS.
And lastly, number five.
This protocol property can be configured
to protect past sessions against future compromises.
One, two, three.
That's gonna be PFS or perfect forward secrecy.
All right, let's go
and do a security and action about wireless connectivity.
Your neighborhood coffee shop offers free Wi-Fi
to their customers.
You did a bit investigating and determined
that their current configuration is WPS 802.11n
with web authentication.
Hmm. Should you connect?
And if not, what feedback might you give the owners?
So just a quick recap here, right?
You're at your neighborhood coffee shop, right?
So just a small little coffee shop.
And you know, the owners
and the managers are really much more concerned
with making your espresso than security probably.
So it's WPS, it's 802.11n,
and it's using we for authentication.
Are you gonna connect to the network?
And if you're not going to,
what feedback do you wanna give the owners?
Go ahead and put me on pause, write down your feedback,
and then come on back.
You should not connect to a web wireless network.
Period.
Web has been broken, it's not secure
and it would put you and every other customer at risk.
The customer wireless network should be configured for WPA2
or WPA3 with backward compatibility enabled.
WPS should be disabled.
There shouldn't be any reason why anyone's getting
next to the router and having to click a button and connect.
And we know that WPS, you know, potentially
introduces a flaw where the WPA2 key could be captured
and that could be problematic.
They should also be aware that their signal
because they're using n, can broadcast up to 250 meters.
Now, they may have a big space and they may want that
or they might say,
"No, we don't need to be broadcasting that
out on the sidewalk and over into our neighbor's property."
So having this conversation with them, again,
this isn't at work.
This is just your neighborhood coffee shop
but helping out others, helping other people to understand
and really working to help secure our community in general.
Definitely, that's security-in-action.
There's your word cloud.
You know what to do.
When you're ready, I'll see you the next lesson.