Security Techniques (Obj 4.1, 4.5)

Question 1

ESS (Extended Service Set)

Answer 1

Multiple WAPs work together to provide seamless network coverage

Question 2

WEP (Wired Equivalent Privacy)

Answer 2

• Introduced in 1999 as part of IEEE 802.11
• Utilizes a static encryption key system
• Considered insecure due to its weak 24-bit initialization vector

Question 3

WPA (Wi-Fi Protected Access)

Answer 3

Introduced in 2003 as an improvement over WEP
Implemented TKIP for dynamic key generation
Inherited some vulnerabilities from WEP
Due to TKIP vulnerabilities, it was susceptible to cryptographic attacks
Insecure due to insufficient data integrity checks in the TKIP implementation

Question 4

WPA2 (Wi-Fi Protected Access 2)

Answer 4

Uses AES protocol and CCMP protocol for stronger encryption
– AES - Advanced Encryption Standard
– CCMP - Counter Cipher Mode with Block Chaining Message
Authentication Code
- Introduced Message Integrity Code (MIC) for integrity checking

Question 5

WPA3 (Wi-Fi Protected Access 3)

Answer 5

Uses AES for encryption and introduces new features.

Question 6

WPA3 Features (page 303)

Answer 6

Simultaneous Authentication of Equals (SAE) - replaces the 4-way handshake with Diffie-Hellman
Enhanced Open (Opportunistic Wireless Encryption)
Updated Cryptographic Protocols - supports 128 and 192 bit AES and uses AEC GCMP
Management Frame Protection

Question 7

Authentication Protocols

Answer 7

EAP (Extensible Authentication Protocol) - authentication framework
PEAP (Protected Extensible Authentication Protocol) - encapsulates EAP within an encrypted TLS tunnel
EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security)
EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling) - Developed by Cisco systems for secure re-authentication

Question 8

NAC (Network Access Control)

Answer 8

Used to protect networks from both known and unknown devices by scanning devices to assess their security status before granting network access
- Can be applied to devices within the internal network or those connecting remotely via VPN
- NAC can be implemented as a hardware or software solution

Question 9

802.1x Standard

Answer 9

Port-based Network Access Control mechanism based on the IEEE 802.1x standard
- Modern NAC solutions build on 802.1x, enhancing features and capabilities

Question 10

Ports Range

Answer 10

Well-known ports (0-1023)
Registered ports (1024-49151)
Dynamic/private ports (49152-65535)