RCIE Course Modules:
3.9 Wireless Security Devices Compliance
What are wireless security protocols?
Wired Equivalent Privacy (WEP), (WPA) Wi-Fi Protected Access, Wi-Fi Protected Access 2 (WPA2), and Wi-Fi Protected Access 3 (WPA3) are security protocols developed to secure computer networks. WPA to WPA 3 was developed by the Wi-Fi Alliance to make networking more secure across scaled systems.
These protocols were developed as a response to the rising number of threats in the current cyber-compliance world. There are hackers with sophisticated technology and tools to create more in-depth hacking encounters. Researchers at the Alliance found serious weaknesses and attempted to fill the gaps with sophisticated protocols.
While WEP was the first protocol, WPA 3 is considered to be the best form of wireless protection in today’s day and age. We’ve come a long way from the old days of compliance and security. While today’s technology is far more sophisticated, the methodology is similar and can be studied.
Wi-Fi security algorithms have been developed over decades now, with many protocols being developed for the challenges at that time. That’s why CCOs need to understand the importance of each protocol and how they apply to legacy and existing systems.
It’s also important to understand the workings of each Wi-Fi security protocol so that a coherent mechanism can be developed that works best with your organization’s framework.
As there are different types of Wi-Fi security devices developed for your enterprise, it’s important to also understand the purpose they serve. WEP and WPA 2 serve distinctly unique purposes, and CCOs should understand the nuances within them.
Not only do Wi-Fi security protocols prevent hackers from entering the system, they provide a security framework and architecture. CCOs can enhance upon these frameworks and borrow from them from a structural perspective.
These Wi-Fi security protocols protect the network and disallow unauthorized access to the system at the same time. They encrypt private data so that no one can access the information laid out within these parameters.
Airwaves are made that much more secure when there is a solid firewall and foundational protection within the architecture.
As we move from WEP to WPA 2 and 3, we see that hacking becomes that much more difficult. It becomes nearly impossible to use brute-force or password cracking methods when trying to gain access into the system.
That’s why CCOs need to be 100% sure about the security systems they’ve put in place, as well as the parameters within each framework.
It’s important for CCOs to stay updated about the latest encryption and wireless security protocols so that they can keep innovating in the domain. It’s also important for the wireless security protocol to remain dynamic and stay lean so that CCOs can create action plans that are emergent with regards to the security needs.
Healthcare CCOs will need to design systems that are more robust than Technology brands CCOs. This is because the wireless security protocols need to account for the nuances within the organization and industry.
When it comes to data-handling, encryption and protocols being designed within the space, there are multiple challenges that need to be addressed with the right wireless security protocol.
Transmitting data from one point to another is always a challenging endeavour, especially as hackers develop more sophisticated tools to gain access. That’s why CCOs need to have the entire organization remain wireless security device compliant, so that there are no leaks within the system.
Hackers can attempt a log-in at any time, which is why CCOs need to remain vigilant when creating a wireless security architecture. When a broadcast is being issued across the internet, there are various listening devices that can be planted within the company. These devices listen for data packets being transferred.
Having a more secure wireless security protocol ensures that full encryption is being accompanied by other sophisticated protocols. This ensures that no amount of hacking can be done at the base network level. However, as the tools become increasingly sophisticated the work becomes complex.
CCOs need to stay updated about the latest trends in wireless security protocols and management. When it comes to compliance, it is an evolving domain, which means that more companies need to continue to change.
Designing a robust wireless security protocol
Depending on the type of systems architecture being used, its always beneficial to use the latest format of wireless security protocol. However, it helps to understand the origins of the wireless security protocol model, so that CCOs can develop better ones in the future.
It’s also helpful to understand the origins of the model as CCOs can design second-tiered models on top of the existing one offered. Many hardware devices have their own standard protocol offered, which means that CCOs will need to find ways to ensure compatibility.
Each model has its own way of working within the parameters laid out. That’s why CCOs need to think about which wireless security protocol needs to be used when.
Ideally, it’s always better to go for a WPA 2 or 3 format. This is because it’s the most sophisticated form of wireless security protocol available and has fewer security gaps. As the wireless security protocols were developed on an ongoing basis, the latest models are most secure.
However, in simpler models the cost of execution and implementation is lower. This makes it a more appealing format of wireless security protocol when protection is not of the essence.
They can be used in more remote applications and formats that don’t require significant upkeep.
As a general rule, if the organization has enough resources, it’s always good to opt for a WPA 2 or 3 wireless security protocol. This is because then the security of the wireless network is critical.
That’s why opting for the most advanced format of communication and network works out best in the long run.
A reference of the wireless security protocol WPA2 can be reviewed below. In its essence the enterprise version of a standard WPA2 can be split up into a few key functions. While each function is important in authentication and verification, there are holes that hackers can leverage.
That’s why CCOs need to understand the various end-points, processes and formats that are involved in the proper working of a wireless security protocol. CCOs can also design solutions that are based off the standards and create more innovative options.
These innovative wireless security protocols can be scaled up to the entire organization and be used as standards in every transmission. This helps in standardizing the compliance process as well, as every end-point will have dictated access within the network.
The objective of a coherent wireless security compliance program is to ensure that the worst-case scenario doesn’t come true. This includes ex-employees, parking lot hackers or even third-party vendors that have gained access somehow.
In the day and age of cloud, it’s important to have a robust wireless security compliance program. Cloud is present everywhere, and CCOs need to design a wireless security compliance program that covers cloud computing as well.
“Let’s say that I’m trying to communicate with somebody, and you want to be able to eavesdrop on what we’re saying. In an offline attack, you can either passively stand there and capture an exchange, or maybe interact with me once. And then you can leave, you can go somewhere else, you can spin up a bunch of cloud computing services and you can try a brute-force dictionary attack without ever interacting with me again, until you figure out my password,” – Kevin Robinson, member executive Wi-Fi Alliance.
If CCOs are to remain compliant to best practises within the wireless security domain, they should enable all stages of the organization to become more aware. This includes using educational resources, as well as technological protocols that disallow unauthorized usage.
CCOs need to design a wireless security compliance program that includes every element within its parameters. The design should be such that it includes simple models of utility and background so that anyone at any stage within the company can remain compliant.
This is the only way that a wireless security compliance program can scale up without using enforcement techniques that are rule-based. Compliance will become a company asset rather than a standard protocol to follow.
Wireless security compliance programs that approach the subject from a multifaceted methodology generally perform better than others. This is because its comprehensive and easier to take in. Otherwise there are multiple standardized approaches that can be emulated.
CCOs need to adopt a wireless security compliance program that is unique to their own organization. This enables better compliance all around and helps in making the company more robust in its approach towards compliance in the wireless security domain.
Wireless security devices compliance from a technology perspective
What is the core technology that enables CCOs to have a more compliant environment? From a wireless protection perspective, there is a standardized approach to ensuring better wireless compliance.
There are technological tools that have become advanced enough to provide a comprehensive security approach.
Let’s look at the basic model of a WPA2 (Wi-Fi Protected Access 2) Enterprise structure.
WPA2 uses the counter mode and cipher block chaining message auth code protocol. This is called the CCMP. It’s based on the Advanced Encryption Standard, referred to as the AES algorithm. The algorithm helps in authentication and data encryption and is a more secure combination of RC4 and TKIP.
Both models – personal and enterprise, are supported and a pre-shared key is combined with SSID to create a PMK. The Enterprise model uses one of the EAP methods to create the PMK.
After exchanging messages, they create a secure PTK. Then encrypted messages can be sent via the transmission model setup, making the WPA2 protocol much safer to use.
Since WPA2 is the standard protocol being used, CCOs need to understand the technological workings of the protocol. Even when employees are on the move, their devices must be protected when using public networks and other areas outside of the company.
Data from Kaspersky Labs suggests that WPA2 is the global standard being used in today’s network era. Even when using cloud computing or remote device networking, WPA2 is the preferred format of networking.
This makes understanding the core technology that much more important. This is where the concept of a RADIUS server comes in. The RADIUS (Remote Authentication Dial-In User Service) server ensures that the connection is authenticated using a previously configured system.
It allows companies to go beyond simple password and username authentication. WPA2 Enterprise is based on the 802.11i model that incorporates the use of a RADIUS. The keying material is securely generated on the RADIUS server and the same material emerges on the WPA2 client.
This creates the vital connection between the two ends, by telling the AP to accept the request. In turn, the RADIUS server sends the keying material in the form of a key message. The server then allows the effective connection based on an authentication format previously agreed on.
What is the 4-way handshake?
Outside of RADIUS (Remote Authentication Dial-In User Service), there is another technology component that CCOs should understand. This helps in ensuring compliance from a technological perspective and creates a more verifiable authentication method.
The 4-way handshake is an essential component of the WPA model of authentication and transmission. It is the essential protocol through which authentication can be made possible. The handshake is designed so that the access point and wireless client can prove to each other that they’re genuine.
They do this by proving that they know the PSK/PMK without disclosing the key. The AP and client encrypt certain messages to one another that can only be decrypted by the PMK. When the decryption is proven to be successful, the connection is established. This helps in ensuring that the connection is made between valid participants.
A brief overview is shared above, with the steps laid out for the handshake to be proven successful. The AP will send a nonce value to the client’s device. The key is generated using the PSK.
The client uses the value shared and generates a PTK, which it sends back along with another nonce value. The AP will respond with its message integrity code (MIC) and GTK. When the transmission is acknowledged, and both parties are in congruence, the connection is established on a technical level.
The 4-way handshake is a critical tool available to all CCOs who can refine the process in their own unique way. As the standard protocol, CCOs can change the authentication method in their own manner by introducing bio-markers, additional tools, and other methods.
There is a stronger need to have more secure handshakes, and a more secure wireless network overall. An attacker could impersonate a real AP and take advantage of the connection. This may never be detected, owing to the fact that there is no physical verification of the connection.
Additionally, hackers can use other methods to hack into the system. The CCO may never come to know what hacker has entered the system at what time, owing to the vulnerabilities that are associated with most generic wireless security protocols.
Let’s review a few in the next section.
Protecting against wireless attacks
A common format of hacking into a secure network is by using the Evil Twin hack. A representation of the evil twin attack is shared above. Essentially, the attacker can create a fake access point to allow them entry in your device. Using a laptop and a wireless card, the attacked can access an AP using an evil twin access point with a similar name.
They can also create a fake address that employees may log-into by mistake, thereby sharing their credentials with that remote access. CCOs must have a secure perimeter and disallow fake or new APs from emerging. This is done by using better firewall technologies and reducing permissions on the devices themselves.
When the Evil Twin bridge is set up, there can be a plethora of possibilities for the attacker to take advantage of.
DNS Spoofing is another common form of attacking a secure network. This is one of the less technologically advanced forms of attacking a wireless network, but one that is highly effective.
DNS Spoofing also combines elements of social engineering, which is why CCOs must educate the employees within the workplace. They should know better than to click on spoofing websites and share their private information.
A common format of the DNS spoofing method is as follows –
A hacker will pretend to be the employee working at a company. They will then share an email to the admin of the company (generally firstname.lastname@example.org or IT@domain.com). They will then contact them via phone or email and claim that they’ve been logged out of their email IDs.
After that they can ask the admin to take a look at the link shared and check to see if it’s working on their end. After the admin clicks on the spoofing link, they’ve given access immediately to the hacker. This is a common form of hacking that requires social engineering skills and low compliance policy strength.
This is another important reason why CCOs need to invest time and resources to create a more secure compliance environment. They also need to analyse all requests and review safety violations occurring in the system.
For a robust wireless security compliance program, CCOs need to focus on the following key areas –
From a technological perspective, there are many tools available to CCOs who can design better programs. This also includes a robust range in premier tools offered by companies such as IBM, CISCO, etc. These tools help in securing wireless networks beyond standard options available in enterprise configurations.
However, when it comes to wireless security protocols, it’s best to opt for WPA3 as it has been designed to cover the gaps left by WPA2.
From a technological stand-point, there are many strategies that CCOs can implement as well from a network security stand-point. These follow best-practises and are available to all CCOs working across domains.
Employees should remain compliant from a technology stand-point and not install unauthorized software or share files with everyone. From a behavioural stand-point there is a shift necessary in the mindset of the employees. This includes changing the way that employees think about compliance as a whole.
Additionally, compliance should become a part of the company vision and mission rather than just being an overlapping layer of processes. When compliance is seen from an organizational perspective, it can change the way that employees see the area of focus.
Managing compliances & Review.
Finally, when it comes to wireless security protocols, it’s important to have a consistent approach to management and review. Having a regularly reviewed wireless security protocol strategy works out best for CCOs that want to stay ahead of the curve.
Additionally, it’s important to review all the compliance issues that may arise over time. There is significant value in having a test-first methodology when trying to scale a policy or technology. Here is where CCOs need to ensure that all wireless security protocol compliance measures are well tested. Regardless of it being WPA2 or WPA3, there needs to be a consistently tested approach to ensuring compliance.
Encryption and Wireless Security Device Compliance
Having strong encryption is an important aspect of a secure network. When it comes to wireless network security protocols, encryption is a strong reason behind its success.
Additionally, encryption allows two distinct points within the network to have a straight-forward connection.
Otherwise, hackers can read packets as they enter the domain. They can also create unwanted connections between two servers, bypassing the 4-way handshake. They can also download and send unencrypted messages across a line of connection freely.
CCOs need to understand the level of encryption being used and whether that is enough for the company they’re working in. For Fintech or Healthcare operations, CCOs need to have stronger encryption to remain compliant to industry regulations.
Additionally, CCOs need to understand whether encryption is allowing the company to scale effectively.
The 802.1X IEEE standard framework for authentication uses a standardized approach to encryption. The user trying to associate itself to a wireless network has to go through this channel. While WPA Enterprise may use TKIP with RC4 encryption, WPA2-E adds a layer of AES encryption.
This makes the overall network that much more secure, allowing CCOs to enable greater control over packets being transferred. This also means that hacking becomes that much more difficult.
However, with certain errors and loopholes being discovered in WPA2, CCOs are being urged to move to WPA3 which is a more secure format. The credentials are stored in a safer manner and the encryption is much better.
With new network protocols being introduced, the Simultaneous Authentication of Equals (SAE) protocol (aka the Dragonfly handshake) requires a new interaction with the net every time.
This ensures that hackers who already have access to the network, don’t have continued access.
It can also help in slowing down the rate of an attempted attack on the network. The password can be made much more secure and the authentication and encryption is made stronger. It also disallows offline decryption of data, as we move towards a more secure network.
As WPA3 replaces WPA2 completely, there will be new standards introduced across organizations. CCOs must be aware of the encryption and authentication methods being used here as well.
WPA3 replaces the PSK exchange with the SAE methodology, per the IEEE 802.11-2016. This makes the key exchange more secure.
CCOs will have to keep innovating to find the best formats of encryption for their network and databases. Servers will also need encryption beyond the standard protocols offered by networks.
CCOs need to understand the various wireless device protocols that exist to protect wireless networks. The encryption technological aspect is also essential to the proper functioning of the network as a whole. When it comes to cyber compliance and wireless security devices, there is a holistic approach necessary.
CCOs need to have a good idea about the technical aspects of working with complex networks.
IoT and wireless security devices compliances
There are billions of smart objects that will be available in the marketplace in the years to come. This means that all of these interconnected devices will need their own network access, using public and corporate connections.
When it comes to IoT and connected devices, it’s important to review each device requirement prior to incorporating them into the network. It’s important to understand how protected they are against attacks on the network side.
As each device is a potential entry-point, companies need to take the right precautions to ensure security. If even one single device can be hacked into, the entire network can be taken down and hacked. This is because the single point of entry provides enough information to access other parts of the network.
What can the savvy CCO do about this?
CCOs need to create robust strategies around protecting their networks from cyber-attacks that use IoT devices. As each device can be configured using effective network protocols, CCOs can create a more robust and compliant environment.
Crafting the right wireless security devices compliance program
From a compliance perspective, there are many challenges that companies are facing on a regular basis. Each industry has its own set of challenges, and more companies are approaching the cyber experts for help.
Data loss is a critical security threat that should be taken seriously across parameters. CCOs need to design protocols and programs that focus on network security. Wireless network security is an important area that falls under the CCO purview.
From a technology stand-point, the compliance officer can create technological innovation within the wireless network security parameters. These includes introducing newer encryption formats, better security features, and greater ways of authentication.
Additionally, when it comes to training and education there are regular programs that CCOs can run to ensure employees understand wireless network security.
Crafting the right program wireless network security compliance program takes time and resources. Compliance officers need to study the existing wireless network security plan and review the loopholes that exist within the network.
There could be cases where the handshake method used isn’t compliant to general practices. Additionally, the PSK methodology may be outdated for certain applications. CCOs need to make the right call and analyse which aspect of their wireless network security needs updating.
From a managerial perspective, CCOs need to work with the IT domain and understand the wireless network security protocols. They can work with third-party vendors and acquire information with regards to the overall network architecture.
CCOs can also manage the wireless network from the dashboard provided by the network setup team. The dashboard can provide an overview to CCOs who want to understand the nuances behind each network node.
CCOs also have to create a program that encompasses various layers of compliances within the overall architecture. This includes different tiers of networks within each area of excellence.
Additionally, CCOs need to understand the unique requirements of each department that requires the network as a unit.
There are significant advantages to incorporating various individual protocols when it comes to network security. This is done to ensure that each layer is stacked correctly from a compliance point of view.
If certain networks governing customer data aren’t protected with an additional encryption layer, then the data could be under jeopardy.
Companies also need to create proper authentication and compliance policies around using the network in the first place. Sharing accounts, sending personal files and providing unauthorized access are a complete no-no. Added to that, there are nuanced regulations that can be employed in additional to best practises.
For healthcare specific domains, the amount of information shared (interoperability) is also critical over the network. The network needs to have enough controls on it to ensure that there are no violations of the various compliance protocols governing it.
What is a WEP?
WEP stands for Wired Equivalent Privacy and was one of the first standardized network protocols. It is a security algorithm for the IEEE 802.11 wireless networks and was introduced as early as 1997.
The intention of the protocol was to provide confidentiality over a wireless network, similar to that when sharing information over a wired network. It was one of the most widely used protocols for almost a decade, before WPA took over and changed the scheme.
WEP is still recognizable today with its key of 10-26 hexadecimal digits. It was designed to be an industry standard in security and cyber compliance. Its roots laid the foundation for much of the security functions we’re seeing today and has been one of the most revolutionary formats of cyber security protocols.
WEP used a basic encryption model to ensure that the messages being relayed were protected. Using WEP, messages could be transmitted without losing their essential meaning. This meant that employees across the globe could share sensitive information to one another.
This enabled the dynamic boost in business at the time, and economies became increasingly digitized. There was more attention being given to enhancing the cipher strength and ensuring that encryption could be made stronger.
Companies that leveraged better encryption under the WEP model would become safe from attackers during the time.
WEP used the stream cipher RC4 for confidentiality and the CRC32 for integrity. This enabled it to become a standard for security protocols. Network transmissions could be made that much more secure, with the help of WEP applications.
There are a handful of legacy operations that leverage WEP and CCOs should understand the origins of the technology and how best to protect the network. The basic WEP encryption included an RC4 keystream and a 40-bit key that was concatenated with a 23bit initialization vector. A reference model is shared below.
Why WEP was replaced was because of its limitations in scope. It had many loopholes through which hackers could gain access and infiltrate secure networks. That’s why WEP was replaced by WAP in 2003. WEP had been suspended by the Wi-Fi Alliance, and there was the introduction of a new model.
There may be legacy systems relying on WEP and CCOs need to understand how best to deal with them. Additionally, there are challenges with backwards compatibility and ensuring proper security in the WEP systems.
It’s best to upgrade them or create new boundaries and systems on how to use them. CCOs can design better compliance programs and enable better protection overall. It’s important to understand how authentication occurs under the WEP model so that CCOs can work within these boundaries.
There are two basic methods of authentication under WEP: Open systems and Shared Key.
Under the Open Systems authentication model, the client doesn’t need to provide credentials to the AP during the transmission. The authentication doesn’t require that the client share credentials to the AP. Instead, any client can authenticate with the AP and create a connection.
In return, the authentication is basically null. WEP keys can be used for encryption data and client must have the right keys.
The alternate model is SKA (Shared Key Authentication), in which the WEP key is used under the 4-step challenge-response handshake. The 4-way handshake forms much of what we know about authentication in today’s cyber-compliance era as well.
⦁ The client shares a request of authentication to the AP.
⦁ The AP responds with a text challenge.
⦁ The client encrypts the challenge text using the WEP key that it has been configured with.
⦁ The client sends back the encryption.
⦁ The AP decrypts the response and checks whether the reply is correct or not.
Through this, no single party has to disclose its credentials in order to connect. It can share an encrypted message and prove to each other that they understand the message.
However, there were significant challenges in using the WEP authentication model. The RC4 is a stream cipher, which means that the same key can’t be used multiple times. The vector is transmitted as plain text, but a 24-bit IV isn’t powerful enough to ensure correct authentication.
Hackers have developed sophisticated methods to hack into the network. They simply waited until 5000 packets were sent for a chance that a 50% probability takes place. That’s when they would attack.
A passive attack can open up security lapses within the network and create an eavesdropping attempt on it. When packets are inspected at scale, a key recovery could be performed. This meant that hackers could gain connection through authentication to the network. They could pretend like they’re an authorized source.
Hackers could also simulate sending packets over time and create a fake connection with the network. They could send multiple packets over and over again until they were able to crack the encryption. It could have been automated to a scale that is unimaginable.
In certain cases, the air-cracking could have been performed within minutes of launch. The weaknesses were glaring enough that a new protocol had to be developed.
What’s the best approach when it comes to WEP?
It’s best to upgrade the network to a WPA2 protocol, as it’s a more reliable and safer protocol to implement. WEP has glaring weaknesses that may not be addressed by organizations any time soon.
If the company has legacy networks that are using WEP, then it’s time to upgrade. Hackers can gain access within minutes and WEP is an outdated format in today’s digital era.
As a transition mechanism, companies can use encrypted tunnelling protocols that can provide a more secure data transmission. Using IPSec or Secure Shell can work in these cases. This can help in strengthening the network to some degree. A reference of IPSec is shared below.
While using an IPSec is an important step, CCOs can also focus on replacing the old Wi-Fi APs directly. They can have their firmware upgraded, if there is support provided. They can also directly talk to the manufacturer and get more information about the upgrading process.
CCOs can also create new policies around using WEP so that the network doesn’t have any contact with other networks. Additionally, employees could be given special instructions and protocols while using WEP networks.
This could help in reducing risk of attacks, while shifting away from WEP network transmissions. CCOs can enhance the overall strength of the security by ensuring that all new hardware products are labelled as Wi-Fi certified as well.
What is a WPA?
WPA stands for Wi-Fi Protected Access and is a more secure protocol when it comes to network transmission. Newer versions of the WPA have been released, with the WPA3 being the most recent one. There are weaknesses with WPA as well, but it’s more secure than WEP.
WPA2 is a more widely used standard as of now, with some control and tools being given to CCOs. However, as we move towards cloud and more sophisticated networking, WPA3 should be on the minds of every CCO.
WPAs use a pre-shared key (PSK) and temporal key integrity protocol (TKIP) for encryption. This helps in ensuring that the connection is unique and secure. No unauthorized person can hack into the network, when the encryption is strengthened.
WPA also uses an authentication server for keys and certification generation. However, the reason why WPA2 was invented was to close out the many gaps that were present in the WPA.
A few years after launch, it was seen that attacks on the Wi-Fi Protected Setup (WPS) – auxiliary system – could help hackers gain access to the network. This gave them an indirect route through which they could hack into the network.
Thus, there was no need for brute force attacking in this case.
WPA was designed to be used as a security enhancement using the TKIP. It had some gaps in terms of security and application, which is why it was replaced by the much coveted WPA2.
WPA has an advantage in terms of lesser processing load, however in scaled operations it’s always safer to bet on WPA2 or 3. This makes it easier to rely on these protocols and keep the network safe overall. WPA is an insecure model, as of today, and shouldn’t be used anymore.
Similar to WEP, WPA should also be replaced with newer hardware and technology that is capable of networking securely. However, in order to do a complete replacement, it’s important to understand the nuances behind WPA and what it offers to the table.
WPA may not work with WPA2 in a compliant manner, which is why CCOs must understand how best to integrate the two. Whether one solution works better than another, replacement may be the best option.
WPA also creates a more compliant environment overall, when compared to WEP. WEP is an outdated model of network security, but WPA is still in use today. CCOs must understand how best to deal with WPA models as well.
Essentially, Wi-Fi Protected Access had a 128-bit TKIP, which meant that the network could make a new key for each data packet. This made the transmission that much more secure and meant that hackers couldn’t force their way into the network.
Because TKIP was designed to be used with WEP devices, it was seen as the bridge between WEP and WPA. However, there were weaknesses found within the WEP model as well, which lead to industry bodies replacing the TKIP format. Then the CCMP or AES-CCMP model was introduced which gave birth to WPA2.
WPA came in two popular formats –
1. WPA – Personal. The personal model became the standard for small business that didn’t need an authentication server. The devices could connect using the same key and access the network securely. As time went on, WPAP became increasingly open to hackers who could spoof their identity.
2. WPA – Enterprise. WPAE was made for larger corporations and was seen as a source of strength under the CCO purview. It was designed to operate with a RADIUS server that could create automatic key generation and authentication. The enterprise was made stronger and hackers had a more difficult time breaking into the system.
The RADIUS server is used to ensure that there is an intermediary between the direct request, as referenced below.
Attacks on the WPA network
There are increasingly sophisticated attacks being conducted on the WPA network. These attacks are making it easier to hack into the WPA network and create a fake connection with the RADIUS.
This is making the work of the CCO that much more complex, owing to the insecure nature of the WPA network. One such example is by using the Fluxion attack.
Essentially, Fluxion automates the process of developing a fake connection to capture WPA passwords. Through this, it can help gain access using the credentials.
The tool helps combine evil twin access point AP and integrated jamming into one attack format. The handshake capture function helps in ignoring the hardware and focus more on the network itself.
The attacker jams the original network and creates a clone with the exact name. This makes the user disconnect from the original network and enter their credentials on the fake network that is being used. Then the user, willingly, enters their username and password and a fake login page is created.
If the hacker understands the design and layout of the real company log-in page, then they can design a fake one as well. This helps capture the data of the user and creates an access point for the hacker.
The Fluxion ecosystem can be created in under $100 by using a Raspberry Pi to do the hard work. That’s why hackers can hack into WPA networks using faster processing. The CCO may not be able to catch the attempt until it’s too late.
That’s why CCOs need to ensure that WPA networks are well protected and disconnected from the main network being used. There should also be compliances and policies around how employees connect to the network in the first place.
There are multiple attacks that can also take place using the Pixie Dust method. The attack framework of Airgeddon can be used to find vulnerable networks within an organization. The hacker can then bully their way into the network.
The attack uses all known points of vulnerability within the network to create points of entry. Using these points of entry, the attacker can create a connection to the network and spoof its identity as being genuine.
Compliance and Wi-Fi Protected Access
It’s important to have a holistic approach when it comes to WPA and compliance. Since these systems are legacy operations, compliance becomes challenging. Every step of the way should be mapped out, starting from how your organization uses WPA.
There may be certain legacy devices that are using WPA, while many others not being updated for some time now. It’s important for the CCO to map out the WPA network within the organization and analyse which areas need to be upgraded immediately.
When it comes to WPA, replacing and upgrading the network is the best approach. Since more connections are becoming increasingly vulnerable, the best option is the replace WPA with WPA2 or 3. The Wi-Fi Alliance recommends that all systems be upgraded to 2 or 3 version.
Since the WPA network relies on the RADIUS server, authentication over RADIUS can be made much stronger. This can aid in transitioning successfully from the WPA network. CCOs can design better authentication and encryption over the server, to ensure that only trusted connections are going through.
Additionally, CCOs can review existing connections being made to review against devices within the network. They can spot any passive hackers that have gained access to the network by running a few tests on the network.
What is WPA2?
WPA2 stands for Wi-Fi Protected Access version 2 and is a newer format of network security. It performs the functions of AES in CBC-MAC to calculate (in parallel) the MIC and AES in counter. An illustration is given below.
Essentially, WPA2 is a more advanced format of network protocol and has become a standard in today’s modern era. It’s one of the more widely used wireless protocols and has a wider reach than its predecessors.
The 802.11i wireless security standard based protocol had a leap in innovation when the WPA2 was introduced. WPA was replaced and the use of AES, or Advanced Encryption Standard, was utilized.
The challenge that WPA2 addressed was the status of the hacker within the network. There was little that a CCO or a network admin could do if the hacker was already inside the network. That’s why newer wireless security standard based protocols addressed this directly.
However, there is still a strong possibility of vulnerabilities being exposed under the WPA2 model. The WPS can still attract hackers who can gain access into the network. When it comes to wireless security standard based protocols, WPA2 is a good option but WPA3 may be better.
From a compliance perspective, a majority of your network devices will be running this wireless security standard based protocol. As WPA2 is the most common form of wireless security standard based protocol in today’s era, CCOs need to be familiar with its workings.
Breaking into this wireless security standard based protocol can take anywhere between 2 to 14 hours, and CCOs may be able to stop the attempt at the source. But, CCOs shouldn’t rely on default settings to provide the security that is needed within the parameters.
As illustrated above, the WPA2 wireless security standard based protocol has a more robust approach to security. Transmission over the WPA2 happen in a more secure manner when compared to older models.
There is also the option of forward compatibility when it comes to WPA and WPA2. This means that CCOs can upgrade their network without there being much hindrance in the network as a whole.
WPA2 is a huge leap from the legacy days of the WEP, but the wireless security standard based protocol still needs upgrading. CCOs should also understand the security features shared and create better protocols within the domain.
The best approach as of now is to use a WPA2+AES protocol. Using this methodology will help in enabling better security all around the enterprise. CCOs can activate the network and control the packets being transmitted through the network.
There are a few downsides to using WPA2.
Chief among the downsides to using WPA2 is the processing capabilities taken to run the wireless security standard based protocol. More hardware capabilities are needed to avoid poor network performance. This means that CCOs need to focus on scaling up operations in a unified manner.
While WEP and WPA are being upgraded, WPA2 must also need more hardware to run the network. As older APs are being removed, newer ones must be integrated well into the network. More capable hardware must be used to ensure a smooth transition.
This requires significant investment and resources if you’re working for a large operation. However, this is a must to plan out and execute if you are to confirm the security of the company. If you are going to experience heavier loads of packet transfer, then a WPA2 is the best approach.
CCOs should consider investing in enhancing the overall architecture of the network as well. This includes all the nodes and how they’re interconnected as well. Additionally, CCOs should understand the nuances of using WPA2 in their organization.
Employees should be made aware of the new protocol and how best to use the new approach. Whether from a compliance perspective or a purely network speed one, employees should be familiar with the technology from day 1.
Protecting the enterprise wireless network
When leveraging the capabilities of the WPA2, it’s important to focus on protecting the enterprise network better. While WPA2 offers more features than WPA, there are protection gaps that need to be filled by the CCO.
Setting a stronger authentication method is one of the best methods when leveraging the wireless security standard based protocol. This is so that CCOs can maintain a proper log of the attempts being made to connect with the network.
Compliance is also key here, as the wireless security standard based protocol strength is based off how compliant employees are in terms of access and sharing files.
Since WPA2 wireless security standard based protocol needs more processing power than WPA, it needs to have a scaled architecture in place. This means that CCOs will have to upgrade their network across the board to make their organizations more compliant.
The KRACK attack exposed a weakness in the WPA2 wireless security standard based protocol. It was able to gain access to a network using key reinstallation attacks (KRACKs). It’s a fairly unique technique that was designed specifically to attack the WPA2 network.
The attacker can also inject malware directly onto all websites that are being accessed via the network. This means that all devices can be compromised when a hacker gains access to the network.
Since there is a chance of a passive attack from emerging, CCOs need to be vigilant about ensuring greater WPA2 security. They need to upgrade all the hardware available and switch to WPA3 if necessary.
Since the weakness is in the standard itself, CCOs may want to explore other options to strengthen the WPA2 for their enterprise. The attacked can decrypt all the data being shared by the compromised device that is logged into the network.
The attack can exploit weaknesses within WPA2 by hacking into a mobile device and gaining control over the entire network. From here, the hacker can read emails and access more information from the network directly.
What is WPA3?
WPA3 stands for Wi-Fi Protected Access version 3 and is the most modern format of wireless protection available. Launched mid-2018, the standard is being rolled out in newer networks and devices.
WPA3 will be the new international standard, especially when it comes to how IoT and wearables are transmitting data over wireless networks. The new standard will be more secure and will provide greater control to the CCO.
It will be available in Personal and Enterprise formats and will provide greater control over the packets being transmitted and authentication protocols used.
WPA3 will add new features to simplify security and enable stronger encryption overall. Data sent over encrypted networks will have greater security measures built-in. This ensures that hackers will not be able to use current-generation tools to hack into the network.
WPA3 may not work coherently with outdated legacy protocols, which means that CCOs will need to upgrade all their systems and networks.
WPA3 Personal and Enterprise will have new features that will dissuade hackers from enabling automated attempts. WPA3-P will have greater protection from password guessing hackers, and WPA3-E will have higher-grade security protocols for more sensitive data.
This means that CCOs can design their more sensitive data to be more compliant with best practises. They can also ensure that their data is protected using a higher-grade security protocol. Additionally, all devices will be certified by the Wi-Fi Alliance, adding an extra layer of protection and authentication.
One of the greatest areas of impact that WPA3 will enforce is the protection against offline hacking attempts. Hackers may not be able to capture data from the Wi-Fi stream and bring it back to their private computer. They may also not be able to use simple decryption tools to unlock the data packets.
Every time a user has to use the network, they need to log-in using a live device. This authenticates users at a physical level and ensures a live connection is being made with the right user.
The chances of brute force attack declines, and more companies are able to leverage better compliance systems using WPA3. Since WPA3-E has greater features over enterprise networks, CCOs have greater control over the content being shared online.
Changes with implementing WPA3 in enterprise
WPA3 solves a lot of the problems that WPA and WPA2 had, when it came to security. WPA3 addresses many common hacking techniques head-on, while providing measures to protect against potential leads.
While DNS spoofing and Evil Twin attacks are still out of the purview of WPA3, these can be easily addressed using additional protocols. Here’s where compliance comes in and creates a uniform log-in and authentication procedure.
WPA3-P will not use PSK anymore and SAE comes into the picture. Simultaneous Authentication of Equals (SAE) will be based on key exchange and is resistant to offline attacks. The data is protected at a much deeper level, with greater emphasis being given to ensuring authorized connections.
It will also focus more on the security tools provided, thereby giving greater access to owners and admins. They will be able to setup the compliances that they see fit, when it comes to WPA3. The protocol gives more power to process owners to create unique protocols.
WPA3-Enterprise will have authenticated encryption of 256-bit counter mode protocol. This ensures that there is greater protection of the network being used. Additionally, hackers may not be able to use brute force to enter the network.
Hashed Message Authentication Mode (HMAC) with Secure Hash Algorithm (SHA) will be used to strengthen the connection. Elliptic Curve Diffie-Hellman (ECDH) exchange and Elliptic Curve Digital Signature Algorithm (ECDSA) will also be used under the WPA3 protocol.
Greater encryption will be provided overall, with more tools being given to compliance officers. The organizational network will be made more secure, with the help of better tools being made available.
Added to the WPA3 launch, the Wi-Fi Alliance is also launching Easy Connect. This will make connecting to a Wi-Fi network that much easier for devices that don’t have displays or are IoT based.
The Wi-Fi Alliance is working on building innovations in the field of wireless protocols that go beyond critical needs. That’s why CCOs need to understand the plethora of tools offered, so that they can approach compliance from a holistic perspective.
CCOs can analyse the tools available and use them to strengthen their existing networks. WPA3 can become a great tool to ensure greater compliance in the organization.
Integrating WPA3 in the organization
From a compliance point of view, WPA3 gives CCOs more control. The protocol also allows for greater connectivity across the board, while providing more access to packets being transferred.
WPA3 is the new security standard that is going to become universally accepted by all organizations. This will create complexities when working with third-party vendors and clients that haven’t upgraded yet. The challenge for the CCO starts from this point, as they upgrade their own systems.
“It’s the next generation of security for personal and enterprise networks. One of the most important roles for the Wi-Fi Alliance is to ensure that the industry is staying ahead of emerging threats. WPA3 will eventually become mandatory. By the time you see the next generation of Wi-Fi hitting the market, you’ll see very strong if not universal adoption. However, while we’re focusing on next-gen Wi-Fi security, the Wi-Fi Alliance continues to maintain and update WPA2.” – Kevin Robinson, vice president of marketing at the Wi-Fi Alliance.
2019 is the year for WPA3, as more tools roll out with giving better encryption. While a majority of the issues are addressed, CCOs need to design better models internally as well.
They can work with WPA3 network protocols to enhance their own network better. These protocols can be designed to become more compliant to industry standards, as well as create better control over the company.
As employees start to use the network protocol, their transfers become more secure against basic attacks. This means that employees will have a safety net if they do become non-compliant. While this is a good picture in the long-run, CCOs must constantly train employees to remain compliant.
Along with training and education, WPA3 provides a technological tool for CCOs to ensure that the organization remains compliant at all times. That’s why it’s being quickly adopted across all industries around the world.
References, papers & e-books
Take Control of Wi-Fi Networking and Security Kindle Edition
by Glenn Fleishman
Optimizing IEEE 802.11i Resource and Security Essentials: For Mobile and Stationary Devices 1st Edition – by Parisa Naraei (Author), Iraj Sadegh Amiri (Author), Iman Saberi (Author)