CCNA 2 - Capitulo 12.6

CCNA 2 - Capitulo 12.6

1. WLAN CONCEPTs

   • WLAN SECURITY
     • 802.11 ORIGINAL AUTHENTICATION METHODS
       • 2 - SHARED KEY AUTHENTICATION
         • WIRED EQUIVALENT PRIVACY (WEP)
           • ENCYPTION METHOD ? STATIC KEY
             • KEY NEVER CHANGES WHEN EXCHANGING PACKETS
             • THIS MAKE IS EASY TO CRACK
           • NEVER BE USED
           • SECURE THE DATA USING
             • RIVEST CIPHER (RC4)
         • WI-FI PROTECTED ACCESS (WAP)
           • ENCRYPTION ALGORITHM
             • TKIP (TEMPORAL KEY INTEGRITY PROTOCOL )
           • ADVANTAGE
             • TKIP CHANGE KEY , MORE DIFFICULT TO HACK
         • WPA 2
           • ENCRYPTION ALGORITHM
             • ADVANCED ENCRYPTION STANDARD (AES)
               • STRONGEST ENCRYPTION
           • WPA 2 PERSONAL
             • THREATS ACTORS CAN LISTEN IN ON THE "HANDSHAKE" BETWEEN CLIENT AND AP
               • AND USE FORCE BRUTE FORCE TO TRY AND GUESS THE PSK
             • OPEN NETWORKS IN WPA 2 ?
               • SEND USER TRAFFIC IS UNAUTHENTICATED
         • WPA 3
           • NEXT GENERATION WIFI SECURITY
           • REQUIRES
             • PROTECT MANAGEMENT FRAMES (PMF)
           • 4 RESOURCES
             • WPA3 - PERSONAL
               • NEW FEATURE THAT PREVENTS BRUTE FORCE ATTACKS AGAINST WPA2
                 • SIMULTANEOUS AUTHENTICATION OF EQUALS (SAE)
                   • IEEE 802.110-2026
                   • THE PSK IS NEVER EXPOSED , MAKING IT IMPOSSIBLE FOR THE THREAT ACTOR TO GUESS
             • WPA3 - ENTERPRISE
               • STILL USES 802.1X/EAP AUTHENTICATION
                 • 802.1X/EAP
               • REQUIRES THE USE OF A 192-bit CRYPTOGRAPHIC SUITE AND ELIMINATES MIXING SECURITY PROTOCOL PREVIUS 802.11 STANDARD
               • ADHERES CNSA - HIGH SECURUTY WIFI NETWRKS
             • OPEN NETWORKS
               • OPPOORTUNISTIC WIRELESS ENCRYPTION (OWE)
                 • ENCRYPT ALL WIRELESS TRAFFIC
             • IOT ONBOARDING
               • WPA2 INTRODUCED WPS (WI-FI PROTECTED SETUP) FOR EASY DEVICE ONBOARDING BUT IT'S A METHOD THAT'S EASILY FOOLED - PIN EASILY DISCOVERED
                 • WPS IS INSECURE → VULNERABLE TO MULTIPLE ATTACKS → NOT RECOMMENDED
               • IOT DEVICES NO BUILD-IN GUI AND NEED ANY EASE WAY TO HET CONNECT WIRELESS NETWORK ?
                 • DEVICE PROVISINING PROTOCOL (DDP) WAS DESIGNED TO ADDRESS THIS NEED
                   • EACH HEADLESS DEVICE HAS A HARDCODED PUBLIC KEY (STAMPED OUTSIDE DEVICE AS A QUICK RESPONSE - QR CODE)
                     • NETWORK ADMINISTRATOR CAN QR CODE AND QUICLY ONBOARD THE DEVICE
           • CURRENT INDUSTRY STANDARD WIRELESS NETWORKS
           • RECOMMENDED METHOD
         • METHOD PERSONAL
       • 1 - OPEN SYSTEM AUTHENTICATION
         • ANY WIRELESS CLIENT EASILY TO CONNECT
         • SITUATIONS WHERE SECURITY IS OF NO CONCERN
           • PUBLICA AREAS : HOTELS , CAFES , REMOTE AREAS
         • WIRELESS CLIENT
           • IS RESPONSIBLE FOR PROVIDING SECURITY SUCH
             • USING VIRTUAL PRIVATE NETWORK
     • SECURITY FEATURES
       • DESPITE THE TWO SECURITY MEASURES BEING EFFECTIVE,
         • THE MAC ADDRESS CAN BE CLONED.
           • EX : CAN I CLONE THE MAC ADDRESS OF A NETWORK THAT AUTHENTICATES BASED ON MAC ADDRESSES AND GAIN ACCESS TO THE NETWORK
         • THE SSID CAN BE DISCOVERED.
           • TOOLS SCAN NETWORK
       • SSID CLOAKING AND
         • CLIENTS MANUALLY SSID TO CONNECT TO THE NETWORK
           • EX : WIZ TV
         • ACCESS POINTS AND ROUTERS ALLOW THE SSID BEACON - BROADCAST
           • TO BE DISABLED
       • MAC ADDRESS FILTERING
         • ADMINISTRATOR CAN MANUALLY PERMIT OR DENNY
           • BASEAD ON THEIR MAC HARDWARE ADDRESS
         • MAB
         • 802.1X

Imágenes y archivos del mapa