CWSP (ABWM) key terms

The practice of moving through an area with a laptop or handheld device that logs wireless beacon frames, producing a map of access points, channels, and security settings. Attackers use it for reconnaissance; defenders use it for site surveys and rogue-device audits.

Any access point connected to an organization's wired network without authorization. It may be installed by a careless employee for convenience or by an attacker for a back door, and it usually bypasses the security controls applied to sanctioned APs.

A fraudulent access point that copies a legitimate network's SSID and often its BSSID to lure clients into associating. Once joined, victims can be steered to fake captive portals or have their traffic captured and relayed.

An attack that sends forged 802.11 deauthentication or disassociation frames to break client connections. It is used to force reconnections so that handshakes can be captured, or simply to deny service to users.

Changing a wireless client's hardware address to mimic an approved device. Attackers use it to slip past MAC-filtering lists or to impersonate a station that already passed authentication, so MAC lists alone are weak access control.

A cracking method that captures a WPA/WPA2 handshake or PMKID and then tests large lists of candidate passphrases against it on the attacker's own hardware, with no further contact with the network and no risk of lockout.

A wireless NIC operating state in which every frame on the channel is passed to the operating system, including frames not addressed to that station. It is required for protocol analysis, WIPS sensors, and most wireless attacks.

A metadata wrapper added to captured 802.11 frames by the driver. It records channel, data rate, signal strength, noise, and antenna information that the frame itself does not carry, so analyzers can interpret radio conditions.

One of the three 802.11 frame classes, used for beacons, probes, authentication, association, and deauthentication. Management frames are unencrypted by default, which makes them the main target for spoofing and denial-of-service attacks.

An amendment that adds integrity protection to certain management frames, chiefly deauthentication, disassociation, and robust action frames. It defeats forged disconnection attacks, but a station only gains the protection after both sides negotiate it.

Management frames in which a station asks whether a named or any network is present, and an AP replies with its capabilities. Probes reveal client SSID preferences and are a primary data source for discovery and location tracking.

A system of sensors, a management server, and often a mitigation engine that continuously monitors the air for policy violations, attacks, and unauthorized devices, then classifies and optionally blocks them.

The process of sorting detected access points into categories such as authorized, neighbor, rogue, and external, using known-AP lists, switch and controller inventories, and wired-side correlation. Classification determines whether an alert or mitigation action is warranted.

An automated WIPS mitigation that transmits targeted deauthentication or disassociation frames to prevent clients from using a device judged malicious or unauthorized. It must be tuned carefully because it can disrupt legitimate neighbors and is legally sensitive.

Two WIPS detection strategies: signatures match known frame patterns and attack tool fingerprints, while anomaly detection baselines normal behavior and flags deviations. Signature methods catch known attacks precisely; anomaly methods can surface novel or misconfigured devices.

A port-based access control framework in which a device must authenticate through an EAP exchange before the network grants normal access. On wireless it is carried inside 802.11 authentication and association, enabling per-user credentials instead of a shared key.

The three 802.1X roles. The supplicant is the client requesting access, the authenticator is the AP or controller that relays requests and enforces the result, and the authentication server is typically a RADIUS system that checks credentials.

An EAP method in which both client and server prove identity with X.509 certificates. It resists password theft and rogue-server attacks, but requires a certificate infrastructure and lifecycle management for every client device.

A protected EAP method that builds a TLS tunnel using only a server-side certificate, then runs a second authentication such as MS-CHAPv2 inside it. Clients must validate the server certificate, or the tunnel can be redirected to an impostor.

A tunnelled EAP method that authenticates the server with a certificate and then extends the TLS tunnel to carry legacy authentication protocols, allowing clients to keep existing username and password schemes with minimal client software.

The AAA protocol most commonly used as the 802.1X authentication server. It receives access requests, checks credentials against a directory or local store, returns accept or reject decisions, and can pass authorization attributes such as VLAN or role.

EAP over LAN carries EAP messages between supplicant and authenticator; after authentication the 4-Way Handshake uses EAPOL-Key frames to confirm both sides hold the pairwise master key and to derive and install fresh session keys.

Techniques that let a roaming station reuse an existing PMKSA instead of repeating full 802.1X authentication. Opportunistic key caching shares a cached key hierarchy among APs, shortening handoffs but giving up some key independence.

A standard that pre-establishes the key material a client will need at neighboring APs, so reassociation skips the full 802.1X exchange. It supports over-the-air and over-the-DS negotiation and is essential for voice and other latency-sensitive roaming.

The AES-based encryption and integrity cipher required by WPA2 and WPA3. It provides confidentiality, authentication of frame contents, and replay protection, replacing the much weaker RC4-based TKIP and WEP designs.

A simultaneous authentication of equals handshake that replaces the pre-shared key handshake with a password-authenticated key exchange. It resists offline guessing of captured exchanges and provides forward secrecy.

The field in beacons and probe responses advertising a network's RSN capabilities, including group cipher, pairwise ciphers, authentication suites, and optional features like management frame protection or fast transition. Clients use it to decide whether they can join securely.

A Layer 3 tunnel that authenticates and encrypts IP packets between peers using protocols such as ESP and AH. Wireless clients commonly use it to protect traffic over untrusted links such as public hotspots.

The signaling protocol that negotiates and maintains IPsec security associations, handling peer authentication, cipher suite selection, and key refresh. It rekeys quickly and can survive network changes, which suits mobile wireless clients.

A remote-access VPN that tunnels traffic inside TLS, usually over TCP 443. Because it looks like ordinary web traffic it traverses most firewalls and captive portals, making it a practical choice for travelers on hostile networks.

A VPN configuration in which only traffic destined for corporate networks goes through the tunnel while other traffic goes directly to the internet. It conserves bandwidth and reduces latency but exposes the device to untrusted networks outside the VPN's protection.

A web interception mechanism that redirects newly associated clients to an authentication or acceptance page before granting broader access. It suits guests and public hotspots but provides no link-layer encryption on its own.

Mapping different WLANs, user roles, or device types onto separate VLANs and applying firewall rules between them. It keeps guests, BYOD devices, and sensitive systems apart even though they share the same physical infrastructure.

A policy enforcement system that checks device identity, health, or posture before or after connection and then places the endpoint in an appropriate network segment or role. Wireless NAC usually relies on 802.1X with RADIUS attributes.

Centralized software that configures, monitors, and reports on wireless infrastructure, covering firmware, templates, RF health, client tracking, and alerts. Many WNMS platforms also host the WIPS console and policy compliance reporting.

Software that enrolls, configures, and polices endpoints such as phones, tablets, and laptops, pushing Wi-Fi profiles, certificates, and passcode rules and enforcing encryption. It is often paired with network access control to verify endpoint posture.

The ongoing process of auditing wireless settings, configurations, and device posture against a written security policy or a standard such as PCI DSS, then documenting and remediating deviations. Regular monitoring turns a static policy document into verifiable evidence.

A written set of rules defining approved wireless hardware, authentication requirements, encryption minimums, guest access limits, monitoring duties, and response procedures. It gives technical controls their authority and provides the benchmark that audits measure against.