Greetings, Tech Talkers!

This is Tor, your trusted network engineering uplink! Today, we're focusing on Wireless Security Protocols, which are essential for protecting wireless networks from unauthorized access and ensuring the confidentiality and integrity of data transmitted over the air.

In this article, we'll explore the evolution of wireless security protocols, compare their features and vulnerabilities, and discuss best practices for securing your wireless networks using these protocols. By the end, you'll have a solid understanding of how to choose and implement the right wireless security protocols for your environment.

Let's get started!

The Evolution of Wireless Security Protocols

Wireless security protocols have evolved over time to address vulnerabilities and enhance security features. The main wireless security protocols are:

1. Wired Equivalent Privacy (WEP)

2. Wi-Fi Protected Access (WPA)

3. Wi-Fi Protected Access II (WPA2)

4. Wi-Fi Protected Access III (WPA3)

Wired Equivalent Privacy (WEP)

Overview:

• Introduced: 1997

• Objective: Provide data confidentiality comparable to a wired network.

• Encryption: RC4 stream cipher with 40-bit or 104-bit key sizes.

• Authentication: Open System or Shared Key authentication.

Vulnerabilities:

• Weak Initialization Vectors (IV):** 24-bit IV is too short, leading to reuse and vulnerability to attacks.

• Key Management Issues:** Static keys are used, making them easy to crack.

• Easily Broken:** Tools are readily available to crack WEP keys within minutes.

Status:

• Deprecated: WEP is insecure and should not be used in any network.

Wi-Fi Protected Access (WPA)

Overview:

• Introduced: 2003 as an interim solution to WEP weaknesses.

• Encryption: Temporal Key Integrity Protocol (TKIP) with RC4 cipher.

• Authentication:

• WPA-Personal: Uses a Pre-Shared Key (PSK).

• WPA-Enterprise: Uses 802.1X authentication with a RADIUS server.

Improvements Over WEP:

• Per-Packet Key Mixing: Enhances security by changing keys for each packet.

• Message Integrity Check (MIC): Protects against forgery attacks.

Vulnerabilities:

• TKIP Vulnerabilities: Still susceptible to certain attacks, though more secure than WEP.

• PSK Weaknesses: Vulnerable to brute-force attacks if weak passphrases are used.

Status:

• Legacy Protocol: More secure than WEP but has known vulnerabilities. Should be replaced with WPA2 or WPA3 where possible.

Wi-Fi Protected Access II (WPA2)

Overview:

• Introduced:

  • 2004 as the official standard (IEEE 802.11i).

• Encryption:

  • Advanced Encryption Standard (AES) with Counter Mode CBC-MAC Protocol (CCMP).

• Authentication:

  • WPA2-Personal (PSK): Uses a Pre-Shared Key.

  • WPA2-Enterprise: Uses 802.1X authentication with a RADIUS server.

Improvements Over WPA:

• Stronger Encryption: AES is more secure than RC4.

• Enhanced Integrity: CCMP provides better data integrity checks.

Vulnerabilities:

• KRACK Attack (Key Reinstallation Attack): Discovered in 2017, allows attackers to decrypt data by exploiting the 4-way handshake.

  • Mitigation:

    • Apply software patches and updates that address the vulnerability.

  • Weak Passphrases in PSK Mode:

    • Still vulnerable to brute-force attacks if weak passwords are used.

Status:

• Current Standard: Widely used and considered secure when properly configured and updated.

Wi-Fi Protected Access III (WPA3)

Overview:

• Introduced:

  • 2018 to address WPA2 vulnerabilities and improve security.

• Encryption:

  • Uses Simultaneous Authentication of Equals (SAE) protocol, also known as Dragonfly Key Exchange.

• Authentication:

  • WPA3-Personal: Replaces PSK with SAE for enhanced protection.

  • WPA3-Enterprise: Offers 192-bit encryption mode for high-security requirements.

Improvements Over WPA2:

• Resilience to Password Guessing Attacks:

  • SAE provides forward secrecy and protects against offline dictionary attacks.

• Protected Management Frames (PMF):

  • Mandatory support enhances protection against eavesdropping and spoofing.

• Simplified Device Provisioning:

  • WPA3 includes Wi-Fi Easy Connect to simplify the process of connecting devices without displays.

Vulnerabilities:

• "Dragonblood" Vulnerabilities:

  • Discovered in 2019, affecting certain implementations of WPA3.

• Mitigation:

  • Update devices with patches that fix these vulnerabilities.

Status:

• Emerging Standard:

  • Recommended for new deployments. Ensure devices support WPA3 and are updated to address known vulnerabilities.

Comparing Wireless Security Protocols

Implementing Wireless Security Protocols

Best Practices:

1. Use the Latest Protocol Supported:

• Prefer WPA3 if devices support it.

• If WPA3 is not available, use WPA2 with AES encryption.

2. Avoid Deprecated Protocols:

• Do not use WEP or WPA with TKIP.

3. Strong Passphrases:

• Use complex, long passphrases (at least 12 characters).

• Avoid common words and include a mix of letters, numbers, and symbols.

4. Update Firmware and Software:

• Keep wireless devices updated to address vulnerabilities like "KRACK" and "Dragonblood".

5. Use Enterprise Authentication for Business Networks:

• Implement 802.1X authentication with a RADIUS server for enhanced security.

• Provides individual credentials and better access control.

6. Enable Protected Management Frames (PMF):**

• Enhances protection against eavesdropping and spoofing attacks.

• Mandatory in WPA3; can be enabled in WPA2.

7. **Monitor Wireless Networks:**

• Use wireless intrusion detection/prevention systems (WIDS/WIPS).

• Regularly audit and assess wireless security.

Configuring WPA2/WPA3 on Cisco Wireless Devices

Example: Configuring WPA2-Personal with AES Encryption

1. Access the Wireless LAN Controller (WLC) or Access Point:

• Use the web interface or CLI.

2. Create or Modify the WLAN:

• CLI Example:

     WLC> config wlan create 1 CorporateWiFi CorporateSSID

3. Set the Security Policy to WPA2 with AES:

• CLI Example:

     WLC> config wlan security wpa enable 1
     WLC> config wlan security wpa wpa2 enable 1
     WLC> config wlan security wpa akm psk enable 1
     WLC> config wlan security cipher aes 1

4. Set the Pre-Shared Key:

• CLI Example:

     WLC> config wlan security wpa psk set-key ascii 1 MyStrongPassphrase

5. Enable the WLAN:

• CLI Example:

     WLC> config wlan enable 1

Example: Configuring WPA3-Personal

1. Ensure Device Supports WPA3:

• Verify that the WLC or AP firmware supports WPA3.

2. Create or Modify the WLAN:

• CLI Example:

     WLC> config wlan create 2 SecureWiFi SecureSSID

3. Set the Security Policy to WPA3 with SAE:

• CLI Example:

     WLC> config wlan security wpa enable 2
     WLC> config wlan security wpa wpa3 enable 2
     WLC> config wlan security wpa akm sae enable 2
     WLC> config wlan security pmf mandatory 2

4. Set the Passphrase:

• CLI Example:

     WLC> config wlan security wpa akm sae passphrase 2 MyStrongPassphrase

5. Enable the WLAN:

• CLI Example:

     WLC> config wlan enable 2

Wrapping It Up

Wireless security protocols are vital for protecting data transmitted over wireless networks. By understanding the differences between WEP, WPA, WPA2, and WPA3, and implementing the latest and most secure protocols, you can significantly enhance the security of your wireless infrastructure.

Until next time, Tech Talkers, keep your wireless networks secure and your data protected!

Thanks,

Tor – Your trusted network engineering uplink