O GoConqr está de visual novo! Conte para nós o que você achou.

Registre-se grátis

Flashcards

Wireless L10 - Implement Basic WLAN Security

michael.0lsn WIRELESS 2 Inglês 74 flashcards

Flashcards do conjunto (74)

  1. 13 Key Elements of SecurityConfidentiality
    Ensure that any intercepted data is not readable
    Ensure that only authorized users and devices are able to access the network
    Integrity
    Ensure that transmitted data and management traffic is not altered in transit
    Availability
    Deal with RF interference, both intentional and accidental
  2. 2Wireless Threats:Rogue APs
    Ad Hoc Networks
    Client Misassociation
    Denial of Service
    Passive Attacks
  3. 3Rogue APThese are APs connected to your wired infrastructure without your knowledge.
    -Honeypot APs
    -Unsecured backdoor access
    Mitigation:
    -Deploy WLC to manage Aps
    -RLDP (Rogue Location Discovery Protocol)
  4. 4AD HOCNetworks are created peer to peer or directly between stations.
    -Passing corporate policies
    Steal info by bridging to the secure wired LAN
    Mitigation:
    - Prevent harm by sending de-authentication frames to keep your stations from associating via ad hoc.
  5. 5Client MisassociationClients who automatically connect to known SSID's may be connected to a spoofed SSID.
    Mitigation:
    Management Frame Protection (MFP)
    -With this method, each management frame includes a cryptographic hash called a Message Integrity Check (MIC).
  6. 6Denial of ServiceNot intended for stealing information
    Can cause network grief, like jamming frequency where your WLAN lives.
    Mitigation:
    Infrastructure Mode.
    Client Mode.
  7. 7Passive Attacks-Usually involve wireless sniffing.
    - Hacker captures large amounts of raw frames to analyze online with sniffing software used to discover a key and decrypt it on the go.
    Mitigation:
    -Intrusion Detection System (IDS)
    -Intrusion Prevention System (IPS)
  8. 8AuthenticationAuthentication is a process of finding out whether something is exactly what it appears to be.
  9. 9Authentication can be performed by using something:-Something you know.
    -Something you have.
    -Something you are.
  10. 10Two-Factor AuthenticationCombination of something you know, you have and you are.
  11. 11Authentication can be used to to identify the _______ connecting to the ______, the ______ of the _______, or _______.The machine connecting to the network.
    The user of the machine.
    OR both.
  12. 12Encryption is the process by whichinformation (plain text) is transformed using a specefic process (the cipher) to produce a result (the encrypted result) that is only readable with the KEY.
  13. 13Creating an encryption method is choosing an ________, and defining a ________.Creating an encryption method is choosing an
    ALGORITHM (A CIPHER METHOD)
    and defining a
    KEY.
  14. 14Encryption can be achieved using ________ or ________ methods.Symmetrical = Same key used for encryption and decryption.
    Asymmetrical = One key for encryption and another key for decryption.
  15. 15Symmetrical EncryptionWith this method, the same process used to encrypt is reversed to decrypt.
  16. 16Asymmetrical EncryptionWith this method, the process used to encrypt (called cipher) is different from the decrypt process (called the key).
  17. 17In the case of wireless security, a key can be ...... common to all users of an SSID or unique to each user.
    -Unique keys are more secure but require a more complex user authentication infrastructure.
  18. 18There are 2 basic types of encryption methods:-Temporal Key Integrity Protocol (TKIP)
    -Advanced Encryption Standard (AES)
  19. 19The initial 802.11 standard described 2 forms of authentication:1) Open Authentication
    2) Wired Equivalent Privacy (WEP)
  20. 20WEP can be used for both ...... authentication and/ or for encryption.
  21. 21With or without WEP, the first step to authentication is the client sending a ____ ____ and the AP sending a ____ ____.Probe request,
    Probe response.
    Once it knows the WLAN characteristics from the probe response, the client sends an authentication request.
  22. 22With Open system, the authentication phase is just a step to ensure that the client is a ...... valid 802.11 device.
    The AP responds with an authentication response indicating a SUCCESS status.
  23. 23With WEP authentication...-AP sends auth response containing the unecrypted challenge text.
    -Client encrypts the challenge text using one of its WEP keys and send it back to AP
    -AP compares the encrypted challenge text with its copy of the encrypted challenge text. If the text is the same, AP will allow the client into the WLAN.
  24. 24WEP-Does not authenticate each packet
    -Initialization vector (IV) > 24 bit /plain text
    -Uses static keys
    -104 bit keys easily cracked
    -One way authentication - only the client is authenticated, thus allowing Rogue APs to impersonate.
  25. 25These 3 key lengths can be used:40-bit key
    104-bit key
    128-bit key
  26. 26IVInitialization Vector (IV)
    -24 bits.
    -An IV is a block of bits that is used to produce a unique encryption key.
    WEP key sizes are combined with the IV. Just add 24 to the bit key size that it's combing with.
    40 > 64 bit
    104 > 128 bit
    128 > 152 bit
  27. 27The data is encrypted using the ________ algorithm and with a key stream that is a combination of the ________ key and the ________.RC4
    WEP
    IV (Initialization Vector)
  28. 28To increase the security of a wireless network, you can also use ________ authentication on the ____/____.MAC
    AP/WLC
    Only those clients present in the MAC address list entered on the AP/WLC have permission to join the cell.
    *This is not a strong security mechanism because spoofing a MAC address is quite easy.*
  29. 29Centralized Authentication Method & Components:-802.1X
    -Extensible Authentication Protocol (EAP)
    -RADIUS
    -Certificates
  30. 30802.1XDefines port-based access control.
  31. 31802.1X 3 RolesSupplicant - provides identity information to the networks.
    Authenticator - Device that controls access to the networks. Acts as relay between the Supplicant and the Authentication Server.
    Authentication Server - RADIUS server that validates the identity info provided and sends authorization attributes such as VLAN, ACL, SESSION TIME-OUT, URL FOR REDIRECTION.
  32. 32EAPEAP describes headers that can be used to identify typical packets of an authentication dialog:
    -REQUEST
    -CHALLENGE
    -SUCCESS
    -FAILURE
    EAP does describe authentication method, just simply describes those headers.
  33. 33RADIUSRemote Dial-In User Service (RADIUS) is the main protocol described for authentication in the 802.1X protocol.
  34. 34In the case of wireless connections, the supplicant exchanges ________ messages with the ________.In the case of wireless connections, the supplicant exchanges 802.1X messages with the AUTHENTICATOR.
  35. 35The ________ translates the ________ messages to ________ messages and forwards them to the ________ server.The AUTHENTICATOR translates the 802.1X messages to RADIUS messages and forwards them to the RADIUS server.
  36. 36These two protocols act as a vehicle to carry an authentication dialog between the supplicant and the RADIUS server, using a specific authentication method such as ...LEAP
    EAP-FAST
    EAP-TLS
    or PEAP
    and using EAP to identify each packet in the sequence.
  37. 37A RADIUS server is a program that checks a set of conditions to ________ or ________ ________ .. A RADIUS server is a program that checks a set of conditions to grant or deny access.
  38. 38A RADIUS server uses, by default, UDP ports 1812 for ________ and 1813 for ________ .A RADIUS server uses, by default, UDP ports 1812 for authentication and 1813 for authorization.
  39. 39Certificates are based on ________ keys.Asymmetric
  40. 40A certificate contains the following information:Username
    Public key
    Serial number
    Valid dates
    The CA’s information
  41. 41EAP Types (3)EAP -Transport Layer Security (EAP-TLS)
    EAP-Flexible Authentication via Secure Tunnel (EAP-FAST)
    Protected EAP (PEAP)
  42. 42REFER BACK TO SLIDES FOR DETAILED EAP TYPE THEORY.REFER BACK TO SLIDES FOR DETAILED EAP TYPE THEORY.
  43. 434-Way Handshake occurs between the ____ and the ____.4-Way Handshake occurs between the client and the WLC.
  44. 44This phase is used to confirm that both sides have the ____.This phase is used to confirm that both sides have the PMK
    Pairwise Master Key
  45. 45The authentication and association process involves the creation of two master keys known as the ________ and the ________.The authentication and association process involves the creation of two master keys known as the Pairwise Master Key (PMK) and the Group Master Key (GMK).
  46. 46The PMK is created as a result of ________ authentications.The PMK is created as a result of 802.1 X/EAP authentications.
  47. 47PMK keys are seeding materials used to create the final dynamic keys that are used for ________ and ________ .PMK keys are seeding materials used to create the final dynamic keys that are used for encryption and decryption.
  48. 48The final encryption keys are known as the ________ and the ________ .The final encryption keys are known as the Pairwise Transient Key (PTK) and the Group Temporal Key (GTK).
  49. 49The PTK is used to encrypt/decrypt ________ traffic.The PTK is used to encrypt/decrypt unicast traffic
  50. 50The GTK is used encrypt/decrypt broadcast and ________ traffic.The GTK is used encrypt/decrypt broadcast and multicast traffic.
  51. 51The 4-Way handshake will always be the final 4 frames exchanged during either ________ authentications or ________ authentication.The 4-Way handshake will always be the final four frames exchanged during either 802.1 X/EAP authentications or PSK authentication.
  52. 52Whenever ____/____ or ____/____ dynamic keys are created, the 4-Way handshake must occur.Whenever TKIP/RC4 or CCMP/AES dynamic keys are created, the 4-Way handshake must occur.
  53. 53Also, every time a client roams from one AP to another, a new 4-Way handshake must occur so that new unique dynamic keys can be generatedAlso, every time a client roams from one AP to another, a new 4-Way handshake must occur so that new unique dynamic keys can be generated
  54. 544 Way Handshake messages.< < ANonce
    SNonce (MIC) > >
    < < Ready to Use MIC, GTK
    OK, use > >
  55. 55WPA offers two authentication mechanisms:Enterprise Mode using 802.1x/EAP
    A Personal mode using Pre-Shared Keys (PSK) for smaller networks.
    In both cases, a Pairwise Master Key (PMK) is generated. The RADIUS passes the PMK to the WLC.
  56. 56WPA encryption relies on ___, just like WEP (for backward compatibility) but with a stronger implementation called ________.WPA encryption relies on RC4, just like WEP (for backward compatibility) but with a stronger implementation called Temporal Key Integrity Protocol (TKIP).
  57. 57In WPA, The IV is brought up to ___ bits.48
  58. 58To avoid packet forgery (where a valid packet is captured and modified), WPA adds a ________ .To avoid packet forgery (where a valid packet is captured and modified), WPA adds a Message Integrity Check (MIC).
    This 8-byte MIC is a checksum taking into account the source MAC address, the destination MAC address, and the entire data payload.
  59. 59With WPA2, ___/___ and ___are still presentWith WPA2, 802.1X/EAP and PSK are still present
  60. 60WPA2: When a client disassociates from a cell, the PMK is kept for one hour.Key caching.
    If the client comes back, it can resume the encrypted communication without needing to reauthenticate.
  61. 61WPA2: When a client authenticates to an AP, the AP can spoof the client MAC address and authenticates in its name to the neighboring APs, thus speeding the client roaming process.Pre Authentication
  62. 62Comparing WPA and WPA2WPA mandates TKIP, and AES is optional.
    WPA2 mandates the AES/CCMP, and doesn’t allow TKIP
    With WPA2, key management allows keys to be cached to allow for faster connections.
  63. 63EAP-TLSEAP-TLS (Transport Layer Security) is an authentication mechanism used in wireless networks that relies on certificates. Key pairs (certificate and private key) are installed on the wireless client and on the RADIUS server.
  64. 64In EAP-TLS, a certificate must be installed on both the _____ _____ and the ________.In EAP-TLS, a certificate must be installed on both the authentication server and the supplicant.
  65. 65EAP-FASTEAP-FAST (Flexible Authentication via Secure Tunneling)
    is a Cisco solution to provide a level of security equivalent to EAP-TLS without the burden of maintaining a complex certificate infrastructure.
  66. 66The concept of EAP-FAST is similar to EAP-TLS; however, EAP-FAST does not use PKI. Instead, EAP-FAST uses a strong shared secret key called a ________ that is unique on every client.Protected Access Credential (PAC)
  67. 67EAP-FAST Protected Access Credential The server generates PAC, and a PAC consists of:PAC-Key
    PAC-Opaque
    PAC-Info
  68. 68The PAC-Opaque contains:PAC-Key
    Client user identity (I-ID)
    Key lifetime
    PAC-Opaque is encrypted with Master-Key.
  69. 69PAC-Info contains the _______ .Authority Identity (A-ID)
  70. 70EAP-FAST is built in three phases:Phase 0 , 1 , 2
  71. 71Phase 0the server generates a Protected Access Credential (PAC) for the client.
  72. 72Phase 1The client establish a TLS tunnel after authenticating each other using the PAC.
  73. 73Phase 2The station is authenticated through the tunnel. This is done with either passwords or security tokens
  74. 74—

Informações

Descrição
2 WIRELESS FlashCards sobre Wireless L10 - Implement Basic WLAN Security , criado por michael.0lsn em 12-04-2016.
Criado por
michael.0lsn
Visualizações
23
Avaliação

Fale Conosco

Sobre o que é sua mensagem?

O que você acha do novo visual?

Você gostou?