Wireless Security Settings - CompTIA Security+ SY0-701 - 4.1

Wireless Network Security Concerns and Solutions

Overview of Wireless Network Vulnerabilities

• Wireless networks transmit data over the air, making them susceptible to eavesdropping by nearby attackers.

• Authentication methods like usernames and passwords are essential for restricting access to authorized users on wireless networks.

Encryption Protocols in Wireless Networks

• Most private wireless networks encrypt traffic to protect data from unauthorized access, ensuring that intercepted packets remain unreadable.

• WPA2 has been a standard encryption protocol but poses security risks during initial connections due to its four-way handshake process.

Risks Associated with WPA2

• Attackers can exploit the four-way handshake in WPA2 to capture hash values associated with pre-shared keys, enabling brute force attacks.

• Advances in technology allow attackers to use GPU processing or cloud services for efficient password cracking within days.

Transitioning from WPA2 to WPA3

• WPA3 introduces stronger encryption through Galois Counter Mode Protocol (GCMP), enhancing data confidentiality and integrity checks.

• The authentication process in WPA3 eliminates the four-way handshake, preventing attackers from capturing hashes for brute force attempts.

Enhanced Security Features of WPA3

• The new simultaneous authentication of equals (SAE) method allows shared session keys to be derived on both ends without transmitting hashes across the network.

• Each user on a network using WPA3 receives a unique session key, ensuring privacy even when using the same pre-shared key.

Authentication Methods in Different Environments

• In corporate settings, centralized authentication via 802.1X is preferred over pre-shared keys for enhanced security.

• Centralized systems often utilize RADIUS or LDAP servers for managing user credentials and maintaining secure access control.

Configurations of Wireless Networks

• Home networks typically use configurations like WPA3-Personal (WPA-PSK), requiring all users to share the same pre-shared key for access.

AAA Framework: Understanding Authentication, Authorization, and Accounting

Introduction to the AAA Framework

• The AAA framework consists of three key components: Authentication, Authorization, and Accounting.

• Authentication involves verifying a user's identity through a combination of username and password, where the password acts as a secret confirming the user's identity.

• Authorization determines what resources an authenticated user can access within the network.

Detailed Breakdown of Each Component

Authentication Process

• A common authentication protocol is RADIUS (Remote Authentication Dial-In User Service), which checks credentials against a AAA server.

• RADIUS is versatile and supports various connection types, including local networks, routers, switches, servers, and VPN access.

• Many devices utilize RADIUS for authentication due to its long-standing support across numerous platforms.

Network Access Control with 802.1X

• The prompt for username and password during login is facilitated by 802.1X, also known as Network Access Control (NAC), which secures network access until valid credentials are provided.

• 802.1X can be applied to both wireless and wired networks in conjunction with AAA servers like RADIUS or LDAP.

Centralized Management via AAA Servers

Benefits of Centralization

• Centralizing credentials on an AAA server allows for efficient management; if an employee leaves the organization, their account can be disabled quickly to revoke network access.

Extensible Authentication Protocol (EAP)

• Within the 802.1X process, EAP (Extensible Authentication Protocol) enables embedding authentication methods that can be customized by manufacturers.

The 802.1X Authentication Process Flow

Steps Involved in Authentication

• The authentication process typically involves three entities:

• The supplicant (the user trying to log in),

• The authenticator (the device being connected to),

• An authentication server or AAA server at the backend.

Interaction Sequence

• Upon attempting connection, the authenticator requests credentials from the supplicant if it detects a new connection attempt.