Wireless Auditing & Risk Assessment

Wireless Auditing & Risk Assessment

1. WLAN Discovery Tools

   • NetStumbler and InSSIDer
     • NetStumbler
       • Free Windows - based Software utility to locate and interrogate WLANS
       • Capture service set Identifier (SSID), access point name, GPS setting, MAC addresses
       • Detect rouge access point
     • InSSIDer
       • Commercial Wi -Fi network scanning application
       • Support Windows & Mac OS
       • Helps with network visualization, optimization & trubleshooting
   • Kismet
     • Wi - Fi scanner (Linux)
     • Detect and interrogates network
       • 802.11a
       • 802.11b
       • 802.11g
       • 802.11n
     • works as network sniffer & detector, intrusion detection system (IDS)
     • determine network IP ranges
     • support built - in channel hopping
     • can "decloak" SSIDs hidden from network
     • useful for wardriving, site surveys & detecting rogue APs
   • HeatMapper
     • Locates & maps radio frequency (RF) footprint
     • present coverage overlaid on floor plan, showing gaps & overlaps

2. Penetration Testing Tools

   • Metasploit
     • pentesting tools : look specific weakness
     • vulnerability scanner : administrator looks to find all known common vulnerabilities & remove
     • mature network to access state of defense
   • Security Auditor's Research Assistant
     • vulnerability scanner
     • integrate with National Vulnerabilities Database (NVD) & Nmap
     • perform SQL injection, Cross - site scripting (XSS) test

3. Password - Capture & Decryption Tools

   • Dictionary - style attack
   • Brute - force attacks
     • cracks password by comparing combinations of possible characters
     • inefficient against strong, complex passwords
   • mitigate threat of password cracking
     • creating strong password
     • different passwords different applications
     • use password management system (PMS) to remember passwords

4. Network Management & Control Tools

   • Wireless Protocol Analyzers
     • security purposes to reveal & locate device
     • excessive probing & scanning behavior indicate virus infection
   • Aircrack - ng
     • built - in protocol analyzer
     • Dictionary - attack tool
   • Airshark
     • pinpoint TCP conversations & threads
     • runs network interface in promiscuous mode to capture all traffic on WLAN
   • Network management systems
     • provides single viewpoint from administrator can view, plan, configure network
     • enables use SNMP

5. Attack Tools and Techniques

   • Radio frequency jamming
   • Denial of Service
   • Hijacking devices
   • Hijacking a session

6. Network Utilities

   • Ping
   • Traceroute / Tracert
   • Netstat
   • Ifconfig / Ipconfig
   • InSSIDer
   • Hotspot Shield

7. Risk Assessment

   • assessment Process
     • all asset related to the system / network
     • known threats affect the security of the system / network
     • system / network vulnerabilities
     • potential impact & levels of risk associated with threat
     • required measures to mitigate the vulnerability & threat
   • determine any change in requirements, technologies / threat
   • determine risk
   • conduct security risk assessment
   • WLANs
     • theft data
     • virus, worms, Trojans
     • leakage of critical information

8. Security Risk Assessment Stages

   • Planning
   • Information gathering
   • Risk Analysis
   • Identifying & implementing controls
   • Monitoring

9. security Audits

   • repetitive checking process occurs throughout cycle
   • to ensure the organization adheres to its own security policies