Instructor: In this lesson we're going to talk all
about how to secure your wireless networks
from some of the threats against them.
Now, wireless networks offer us a lot of convenience
but it also brings a ton of security risks
because unlike a wire network, as long as I'm within
the footprint of that wireless signal, I can connect
to it with my smartphone, my tablet, or my laptop.
To protect your network, you really need to make sure
you know what your devices are connecting to
and once they're connected, you want to make sure
that the data being sent is going to be encrypted.
Now the first thing we want to do is make sure
that whatever we're transmitting is being done privately
to increase the security of our networks.
One of the ways we do this
is what's called a pre-shared key.
Now, a pre-shared key is where both end points,
both your access point and your client on your laptop
or smartphone have the same encryption key.
If I use a password on one side and the same password
on the other and they match that is using the same
pre-shared key to create that encryption tunnel.
Now there are a couple of problems
when you use a pre-shared key though.
First, scalability becomes a big problem for us.
Let's say I have an office where I have 50 different users
and they're all connected to the wireless network
and all of them are using that same pre-shared key.
But let's say tomorrow I go into work
and I fire one of the employees.
Now, that employee knows the pre-shared key,
so guess what we have to do?
We have to change the pre-shared key
and because I have to change that pre-shared key,
all 50 of the other employees now need to be told what
that new key is and so we can all change it.
It's like changing the key to your front door of your house.
If you have 10 family members,
you now have to make 10 copies of that key.
Since all of your clients are using the same password
and that same key, it makes it really difficult
for us to change and do proper key management.
That's one of the big reasons why we don't
use pre-shared keys in large environments.
But if you're in a small office or a home office environment
like your house or a small office of 10 employees
or less you may go ahead and use a pre-shared key
because it's really easy to configure networks that way
'cause you only have a couple of devices.
Now when we look at wireless security,
there are three main methods that we can use for doing this.
The first is WEP, and then we have WPA and WPA2.
When we deal with WEP, we're talking
about Wired Equivalent Privacy.
This was the original wireless security
that was invented all the way back
with the first version of wifi with 802.11.
Now, it claimed that it was as secure as wired networks,
hence the name "wired equivalent privacy."
But the truth is it is not secure
and these days you should never ever be using WEP
because it is a very insecure protocol.
Now, the way WEP works is that it uses a pre-shared key.
Everyone has the same key and it's a static 40 bit key
which is very small and easy to brute force
or guess using a strong computer.
Over time to make WEP more secure,
they upgraded the key from 40 bits to 64 bits
and then again to 128 bits and that solved
the key length problem, but it didn't solve
a different problem known as the initialization vector.
Now the way WEP works is it
uses a 24 bit initialization vector
which is a series of 24 ones and zeros
and they are going to be called this initialization vector.
This is sent in clear text and if you capture enough
of these initialization vectors you can
actually crack the encryption key and backwards guess
the pre-shared key that you used for your password of WEP.
In fact, using Aircrack NG, you can do this in
about two to three minutes with most modern laptops.
Now, the next one we want to talk about is WPA.
WPA or Wifi Protected Access was the replacement
for WEP because of the weakness
with this 24 bit initialization vector.
To overcome this, they introduced something known
as TKIP, the temporal key integrity protocol.
Now TKIP is replacing that 24 bit initialization vector
with a new vector that's 48 bits long.
This doubled the strength of it
but that's still considered pretty weak
when it comes down to modern computing.
The other thing they did was they added
a new encryption type called RC4,
or Rivest Cipher 4 and it's pretty good, but again,
by today's standards this is considered weak.
WPA also wanted to add some integrity to your devices
and they did that by making sure nobody can conduct
a man in the middle attack and change the information.
To do that, they used a thing called the MIC,
the message integrity check, which is a form
of hashing the data before it was sent
and that way you could verify it wasn't modified
as it was in transit as it went through the network.
Now, WPA also saw that there's a flaw
with this pre-shared key and being able
to send out new keys very quickly, so they added
something known as enterprise mode inside WPA.
With enterprise mode a user could
actually authenticate before exchanging keys
and they had then be able to create new keys
temporarily between the client and the access point.
This tried to solve that pre-shared key scalability issue
but the end of the day WPA is still considered weak
by today's standards and is replaced
with a more modern version known as WPA2
or Wifi Protected Access 2.
Now, WPA2 is the current standard
and those created as part of the 802.11i standard.
It was first implemented, it was Wireless G,
and then in Wireless N and Wireless AC.
It requires stronger authentication
and stronger encryption and integrity checks.
The integrity checking is done through using CCMP.
Now, CCMP stands for the Counter Mode
with Cipher Blockchaining Message
Authentication Code Protocol,
which is a mouthful that you will not have
to memorize for the exam or what it means.
What you do need to remember is every time you see CCMP
you should be thinking about this is part of WPA2 security.
The second thing they did was they replaced
that older encryption mechanism of RC4
through VES Cipher 4 with the new one known
as Advanced Encryption Standard or AES.
Now AES uses 128 bit key and some newer models
can actually use a 256 bit key or more.
This gives you additional security and confidentiality
of your data going over this wireless network.
At the time of this particular recording,
AES has still not been broken and WPA2,
the algorithm itself has not been broken
so it is a good thing to use
if you have a long, strong password.
Now, the only way that people are able to crack
these networks currently is by using password attacks
and that means they're trying to guess the passwords
by guessing every possible option using
a brute force attack or a dictionary attack.
So, if you want to protect your networks,
make sure you're using a good, long, strong password.
WPA2 also supports two different modes depending
on your network that you're going to be using it on.
If you're using it in a home or small office environment,
you're going to be using a pre-shared key
where everybody has the same password.
This is known as personal mode.
The other way is by using it in a large environment
where you're using enterprise mode
and that's where each and every user
gets a single username and password unique to them
and they'll use a central authentication server
using native WPA2 or offloading that
to an 801.1x authentication server.
For the exam, I want you
to remember four things about wireless security
and if you remember the four things
on this chart you're going to do great.
First, anytime you see the word open
in reference to a wireless network,
that means no security, no protection, no password.
If you hear WEP, I want you
to associate this with initialization vectors.
That's the flaw in WEP
and that's what you're going to hear about on the test.
WEP is weak, WEP is bad.
WEP uses initialization vectors.
If you see WPA, I want you to think
about TKIP and RC4 because TKIP was all used
to replace the initialization vectors
and RC4 was its form of encryption.
Again, WPA is considered weak, don't use it.
Next, if you see WPA2, you should be thinking
about the acronyms of CCMP and AES.
CCMP is an Integrity Protocol
and AES is the encryption mechanism we use.
This is your key to answering wireless questions
for security on exam day.
Next, let's talk a little bit about MAC address filtering.
We can configure our access points with an ACL
and this will be able to look at those addresses
and permit or deny certain MAC addresses
from connecting to the network.
For instance, if my iPhone tries to connect to the network
and it's not authorized or it's on the Deny list
it won't be able to make that handshake
and it won't be able to communicate.
Now, the problem with Mac filtering still
resides with the fact that it's really easy
to change your MAC address and spoof it.
Knowledgeable users can change their Mac address
really quickly using freely available tools
and it really does take about five seconds to do.
This will stop some people
but it is not foolproof and it's not going to stop everybody.
If you want to change your Mac address
and you use tools like Mac Address Changer for Windows,
Mac Daddy X for OSX and MAC systems,
or Mac changer for Linux,
these are all really easy tools to use.
Mac addresses are not going to be a source
of great protection for you, but according to the exam,
it is a protection that you can use to form
a part of your defense and depth strategy.
So in the real world, don't worry too much
about Mac filtering, but for the exam,
they do consider it a good security measure.
Next, we have disabling your SSID broadcast
which is considered a minor security help
as well to protect your networks.
Now, according to the exam, just like MAC filtering
they say this is a good thing to do.
In the real world though it doesn't
take very long to find a hidden SSID.
Now, what exactly is an SSID?
Well, it stands for the server set identifier
and it's what your wireless network is actually called.
For example, if you go to Starbucks,
they have one called "Starbucks Guest"
or if you go to my house, I have one called "Dion"
and that way you can see that server set goes out
and says, "Hey, Dion is here, should I connect to it?"
And if you search for a network,
you see all the list of names that are around you, right?
Well, if you turn off the broadcast of the Server Set ID,
it's not going to broadcast that out
and it won't show up in your available networks.
This way, the user has to manually type
in the name to connect to your network
so they have to actually know it's there.
Now, the problem with this is that using
wireless penetration techniques, it's really easy
to find these and you'll still be able to connect to them.
If all you're doing is disabling your broadcast,
it's not very secure.
But if you do this in combination with MAC filtering
and having a good long, strong password,
you're starting to layer the security
and give you a better security posture.