Security is an essential aspect of wireless networks because such networks are a shared and open medium with no default protection so everyone can access it. The solution to confidentiality issues is to encrypt the data that flows through a Wi-Fi environment so that only people who are authorized can transmit and receive data.
The original 802.11 standard was not built with great security features in mind. The first WLAN security mechanism was Wireless Equivalent Privacy (WEP) and it emerged with the 802.11b standard. WEP offers different levels of encryption, with keys of 64 or 128 bits in size. WEP is a faulty security mechanism and it is vulnerable to several types of attacks because it is built on the RC4 protocol. A series of WEP vulnerabilities were made public in 2001, which makes this a less preferable encryption protocol. If an attacker gathers enough packets, he will easily discover the entire WEP key.
Wi-Fi Protected Access (WPA) became available in 2003 and was intended as an intermediate measure in anticipation of the availability of the more secure and complex WPA2. WPA uses dynamic key management, adds a stronger encryption cipher, and is built on the EAP/802.1X mechanism. It uses the Temporal Key Integrity Protocol (TKIP) and the initialization vector has been increased to 48 bits (more than 500 trillion key combinations). Some of the WPA characteristics include the following:
- It is used with RADIUS in the enterprise
- It uses an encrypted hash
- Every packet gets a unique encryption key
The recommended WLAN security protocol is WPA2, based on the 802.11i architecture. WPA2 can be integrated with the 802.1X architecture that can work on top of either an 802.3 (wired) or an 802.11 (wireless) environment. This allows individual users and devices to authenticate using the Extensible Authentication Protocol (EAP) and an authentication server (RADIUS or TACACS+). WPA2 and 802.11i also involve the Robust Security Network (RSN) concept that is used to keep track of the associations to the access points.
Some of the key differences between WPA and WPA2 include the following:
- RC4 encryption is replaced by AES
- TKIP is replaced by CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol)
For confidentiality, integrity, and origin authentication, you should go beyond the Data Encryption Standard (DES) algorithm and look at the Advanced Encryption Standard (AES) for strong encryption at the enterprise level (128 bit, 256 bit, or beyond).
Another security design issue you have to deal with is unauthorized access. In wireless networks there are no physical boundaries so attackers can gain access from outside the physical security perimeter. They can introduce rogue access points or soft access points on laptops or handheld devices that can breach security policies. As wireless signals are not easily controlled or contained, this could create security issues for the network.
MAC address security can be used to allow only certain devices to associate with the access points but this cannot prevent MAC address spoofing techniques. Another solution involves MAC address filtering but this is not very scalable when dealing with a large number of wireless clients. The most efficient solution to this problem is using 802.1X port-based authentication, which will be described in a subsequent section.
Another important security aspect in WLAN networks involves controlling WLAN access to servers. Just as you would place DNS servers that are accessible from the Internet in a DMZ segment, you should apply the same strategy to RADIUS/TACACS+ and DHCP servers used in the wireless LAN solution. These servers should be placed into their own VLAN that has a strictly controlled network access policy. These servers should also be protected against Denial of Service (DoS) attacks using Intrusion Prevention System (IPS) solutions