Affects range, coverage, signal strength, and security.
Should be placed near center of facility to minimize the risk of unauthorized access.
Always place in a higher location to minimize interference.
Extended Service Set (ESS) configuration: Multiple wireless access points work together to create unified and extended coverage area for users.
Interference:
Co-channel: Two WAPs are in same area and use the same frequencies, causing data to be retransmitted.
Adjacent Channel Interference: When channels selected for adjacent WAPs do not have enough space between the channels. Always select Channels 1, 6, and 11 when operating in the 2.4 GHz wireless frequency band.
Open Question: Need to insert a chart showing 2.4 GHz overlapping channels (1, 6, 11).
Site Survey: Process of planning and designing a wireless network to provide required wireless coverage, data rates, network capacity, roaming capability, and quality of service levels.
Heat Map: Graphical representation of wireless coverage, signal strength, and frequency utilization data at different locations on a map.
Wireless Security Settings
Wired Equivalent Privacy (WEP): Outdated 1999 wireless security standard meant to match wired LAN security for wireless networks. Uses fixed encryption key for all devices on same network (can be 64 or 128 bit).
Wi-Fi Protected Access (WPA): Temporary improvement over WEP introduced in 2003. Improved security with TKIP which generates new 128-bit keys for each packet. WPA is insecure due to lack of sufficient data integrity checks on the TKIP implementation.
Wi-Fi Protected Access (WPA2): Improved data protection and network access control by addressing weaknesses in WPA version. Replaced WPA’s TKIP with AES protocol. Also adopted Counter Cipher Mode with Block Chaining Message Authentication (CCMP) for strong encryption.
Wi-Fi Protected Access 3 (WPA3): Latest version, uses AES encryption and introduces new features like SAE, Enhanced Open, updated cryptographic protocols, and management protection frames.
Simultaneous Authentication of Equals (SAE): Enhances security by offering a key establishment protocol to guard against offline dictionary attacks.
Enhanced Open / Opportunistic Wireless Encryption (OWE): Provides individualized data encryption even when no password is set.
Management Protection Frames:11. [PMF (Protected Management Frames) encrypts management frames (like deauthentication) to prevent attackers from spoofing them and kicking users off the network. Required to protect network from key recovery attacks. Prevents: Eavesdropping, forging, and tampering.
Authentication, Authorization, and Accounting (AAA) Protocol: Plays a vital role in network security by centralizing user authentication to permit only authorized users to access network resources.
Remote Authentication Dial-In User Service (RADIUS): Client/server protocol offering AAA services for network users. Confirms user IDs via a central server and enforced predefined access rules.
Terminal Access Controller Access-Control System Plus (TACACS+): Separates function of AAA for more granular control over processes than RADIUS. Uses TCP and encrypts authentication process.
Authentication Protocols
Confirm user ID for network security and authorized access.
Extensible Authentication Protocol (EAP): Authentication framework that supports multiple authentication methods.22. EAP is a flexible framework that allows various authentication methods (passwords, certificates, tokens) to be used inside a standardized envelope.
Protected Extensible Authentication Protocol (PEAP): Authentication protocol that secures EAP in a TLS tunnel. Developed to transport authentication data over 802.11 WiFi.
Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-TTLS): Authentication protocol that extends TLS support across multiple platforms. EAP-TTLS requires a certificate on the server, while PEAP requires a certificate on both the client and server.
Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling (EAP-FAST): Enables secure re-authentication while roaming within a network without full authentication each time.
Application Security
Critical aspect of software development that focuses on building applications that are secure by design.
Input Validation: Acts as gatekeeper to ensure that applications only act on well-defined and uncontaminated data. Validation Rules delineate acceptable and unacceptable inputs.
Secure Cookies: Cookies transmitted over HTTPS to prevent eavesdropping.
Static Code Analysis (SAST): Method of debugging an application by reviewing and examining its source code.
Dynamic Code Analysis: Testing method that analyzes an application while it is running.
Fuzzing: Finds software flaws by bombarding it with random data to trigger crashes and security vulnerabilities.
Stress Testing: Evaluates stability and reliability of a system under extreme conditions.
Code Signing: Confirms identity of software author and confirms code has not been altered or corrupted since it was signed. Does not guarantee security, only integrity.
Sandboxing: Used to isolate running programs and limiting resources they can access and the changes they can make to the system.
Network Access Control (NAC)
Scans devices for their security status before granting network access, safeguarding against both known and unknown devices.
Persistent Agent: Software installed on a device requesting network access.
Non-Persistent Agent: Users connect to Wi-Fi, access a web portal, and click a link for login in these solutions.
IEEE Standard 802.1x: Port-based NAC. Most modern NACs are built on this and add extra methods.
Web and DNS Filtering
Web and DNS filtering is often used to prevent access to malicious websites and enforce Internet usage policies.
Web Filtering: Restricts/controls content a user can access on the Internet.
DNS Filtering: Blocks access to certain websites by preventing translation of specific domain names to their corresponding IP addresses.
Email Security
DomainKeys Identified Mail (DKIM): Allows receiver to check if email was sent by the domain it claims to be sent from and if content was tampered with during transit. Adds digital signatures to headers of email.
Domain-based Message Authentication, Reporting, and Conformance (DMARC): Email-validation system designed to detect and prevent email spoofing. Lets administrator publish a policy on how emails should be sent from domain and how receiver should deal with failures.
Email Gateway Protocol: Server/system that is entry and exit point for emails.
Spam Filtering: Process of detecting unwanted and unsolicited emails and preventing them from reaching a user’s inbox.
Endpoint Detection and Response
Endpoint Detection and Response (EDR)
Category of security tools that monitor endpoint and network events and record the information in a central database for further Analysis, Detection, Investigation, Reporting, and Alerting.
File Integrity Monitoring
Used to validate integrity of Operating System and application software files using a verification method between current file state and a known, good baseline.
Extended Detection and Response (XDR)
Security strategy that integrates multiple protection technologies into a single platform to improve detection accuracy and simplify incident response process. Consolidates network security, email security, and endpoint security into a single platform.
User Behavior Analytics (UBA)
Uses big data and machine learning to analyze user behaviors to detect security threats. Aim is to spot anomalies in established patterns from the baseline.
User and Entity Behavior Analytics (UEBA): Built on foundation of UBA with monitoring of entities as an additional function.
Selecting Secure Protocols
Protocols: Set of rules or procedures for transmitting data between electronic devices. Always select an encryption protocol to protect data during network transfers.
Ports: Logical construct that identifies specific processes/services in a given system.
Transport Methods: Way data is moved from one place to another, usually TCP or UDP.
Transmission Control Protocol (TCP): Connection-oriented protocol that ensures data is delivered without any errors.
User Datagram Protocol (UDP): Connectionless protocol that does not guarantee data delivery. Faster and less reliable.
[PMF (Protected Management Frames) encrypts management frames (like deauthentication) to prevent attackers from spoofing them and kicking users off the network.↩︎
EAP is a flexible framework that allows various authentication methods (passwords, certificates, tokens) to be used inside a standardized envelope.↩︎