Unit 3: Local networks · Lesson 5 of 7 · 18 min
Auditing Wi-Fi security settings
Read the controller's network list, find the weak ones and write the target settings for each.
mission
- You are
- The network engineer reviewing the office wireless setup.
- Situation
- The wireless controller export is in
~/wifi/ssids.csv. Staff, guests and printers share the same access points. - Goal
- Rate each network's security and decide what it should become.
- Hand in
- A table of networks with today's setting and the target.
Wi-Fi security from weakest to strongest
- WPA3-Enterprise with EAP-TLSa certificate per device, no shared secret, management frames protected
- WPA3-Personalshared passphrase, but resistant to offline guessing
- WPA2-Personalone passphrase for everyone; a leaked one opens the network until changed
- Openno encryption on the air; fine only for an isolated guest network
List the networks and their security
Look at four columns: the security mode, how people authenticate, and whether management frames are protected (PMF).
cut -d, -f1,3,4,5 ssids.csv
ssid,security,auth,pmf
corp-staff,WPA2-Personal,shared passphrase,optional
corp-secure,WPA3-Enterprise,802.1X EAP-TLS,required
corp-guest,Open,captive portal,disabled
corp-iot,WPA2-Personal,shared passphrase,disabled
you should see One network is WPA3-Enterprise. Staff still use a shared WPA2 passphrase.
Read the notes on shared passphrases
A passphrase shared with hundreds of people stays valid after they leave, unless it is changed.
grep Personal ssids.csv | cut -d, -f1,7
corp-staff,passphrase last changed 2023-02-01
corp-iot,printers and screens
you should see The staff passphrase has not changed since February 2023.
defender tip Move staff to 802.1X with device certificates. Leaving staff lose access the moment their account or certificate is revoked.
corp-staff
security: WPA2-Personal auth: shared passphrase (2023) pmf: optional
Everyone who ever worked here can still join.
security: WPA3-Enterprise auth: 802.1X EAP-TLS pmf: required
Per-device identity, revocable, protected management frames.
Check guest and device isolation
Guest and IoT networks should be in their own VLANs, and guests should not be able to reach each other.
grep -E 'corp-(guest|iot)' ssids.csv | cut -d, -f1,2,6
corp-guest,90,yes
corp-iot,30,no
you should see Guests are isolated on VLAN 90. The IoT network has no client isolation, so a compromised screen can reach every printer.
Check protected management frames
Without PMF, anyone nearby can forge disconnect frames and push devices toward a fake access point.
cut -d, -f1,5 ssids.csv
ssid,pmf
corp-staff,optional
corp-secure,required
corp-guest,disabled
corp-iot,disabled
you should see Only corp-secure requires PMF.
What a defender takes away
- 1Staff Wi-Fi should identify each device, not share one secret.
- 2Require protected management frames to stop forged disconnects.
- 3Guest and IoT networks belong in their own VLANs with isolation.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.