CWSR cheat sheet

Threat model triad for WLANs: confidentiality (eavesdropping on cleartext 802.11), integrity (frame injection, deauth spoofing), availability (RF jamming, management-frame floods).

Open/WEP networks expose all traffic to passive capture; WEP RC4 with 24-bit IV repeats keystreams after roughly 5,000-16,000 frames, enabling key recovery via FMS/PTW attacks.

Risk score = likelihood × impact; likelihood rises with signal bleed outside the physical perimeter (measured in dBm at the boundary), rogue AP density, and PSK sharing.

Hidden SSID is not a control: beacon suppression hides the name only, and probe requests/responses still disclose it to any monitor-mode client.

MAC filtering fails against spoofing because MAC addresses are transmitted in cleartext in every frame header; treat it as inventory hygiene, not access control.

Site survey for risk: record RSSI at building edges and parking areas; -67 dBm or stronger outside the perimeter indicates coverage leakage requiring power or antenna adjustment.

Asset classification drives encryption choice: PCI DSS scope, HIPAA ePHI, and regulated data require WPA2-Enterprise or WPA3-Enterprise, never PSK for staff devices.

Common WLAN attack categories to enumerate in an assessment: evil twin, karma/probe-response, deauth/disassoc flood, PMKID capture, KRACK, and downgrade to WEP/WPA.

802.11 management frames (beacon, probe, auth, assoc, deauth, disassoc) are unauthenticated by default; 802.11w Protected Management Frames signs selected robust frames with a management frame protection IGTK.

802.11w protects deauth, disassoc, and action frames (robust frames); it does not protect beacons, probes, or association requests, which remain forgeable.

Frame types: management (0), control (1), data (2); the Protected Frame bit sits in the Frame Control field and indicates the frame body is encrypted.

4-Way Handshake derives PTK from PMK, ANonce, SNonce, and MAC addresses; the PMK is never transmitted, and the GTK is delivered encrypted in message 3.

KRACK targets the 4-Way Handshake by forcing nonce reuse, especially in the Group Key Handshake and the all-zero-key case on some implementations; patching clients and APs is the mitigation.

CCMP uses AES-128 in CCM mode with a 48-bit packet number (PN) as the replay counter; TKIP used RC4 with a 48-bit TSC and is deprecated by 802.11-2016.

GCMP-256 (WPA3-Enterprise 192-bit mode) uses AES-256-GCM with 256-bit keys and is required for CNSA/192-bit suite compliance.

Beacon frames advertise RSNE capabilities; a forged beacon can downgrade-advertise by stripping RSNE or offering only TKIP, so clients should be configured to refuse weak ciphers.

WPA (TKIP) = RC4 + per-packet key mixing + MIC (Michael) + 48-bit TSC; certified from 2003 as a firmware upgrade to WEP hardware.

WPA2 = 802.11i RSN with CCMP/AES-128 mandatory; PSK mode uses PBKDF2-HMAC-SHA1 with 4096 iterations and the SSID as salt to derive the 256-bit PMK.

WPA3-Personal replaces PSK with SAE (Dragonfly), a PAKE giving forward secrecy and resistance to offline dictionary attacks on captured handshakes.

SAE supports H2E (hash-to-element) to avoid the dragonblood side-channel; transition mode (WPA3/WPA2 mixed) reintroduces downgrade risk because it still accepts WPA2 handshakes.

WPA3-Enterprise offers 192-bit mode using GCMP-256, HMAC-SHA-384 for key derivation, and ECDHE/ECDSA with 384-bit curves; suites are defined in 802.11-2016 and CNSA guidance.

PMF (802.11w) is optional in WPA2, mandatory in WPA3; WPA3-Personal requires PMF and forbids TKIP and WEP.

Device Provisioning Protocol (DPP, 'Wi-Fi Easy Connect') uses QR codes or NFC to onboard devices without PSK sharing; it is an alternative to WPS, which is deprecated due to PIN brute force.

RSN vs WPA: RSNE in beacons distinguishes 802.11i; WPA used a vendor OUI in the WPA IE, so a client seeing only the WPA IE is on legacy TKIP.

802.1X roles: supplicant (client), authenticator (AP/controller), authentication server (RADIUS); EAPOL runs between supplicant and authenticator, RADIUS carries EAP between authenticator and server.

EAPOL-Start → EAP-Request/Identity → EAP-Response/Identity → EAP method exchange → EAP-Success; the AP opens the controlled port only after success.

EAP-TLS: mutual certificate authentication, strongest method, requires client certs; resistant to password capture and rogue-server attacks when the client validates the server cert.

PEAPv0/MSCHAPv2: server cert + inner username/password; the client must validate the server certificate or it is vulnerable to an evil-twin RADIUS.

EAP-TTLS: like PEAP but allows arbitrary inner methods (PAP, CHAP, MSCHAPv2); inner PAP inside a TLS tunnel is acceptable because the tunnel provides confidentiality.

EAP-FAST uses a PAC (Protected Access Credential) for fast reconnection; PAC provisioning must be done in a trusted tunnel or it is vulnerable to MITM.

LEAP and EAP-MD5 are deprecated: LEAP is crackable via ASLEAP, and EAP-MD5 offers no key material suitable for encryption and no server authentication.

Machine vs user authentication: machine certs allow login before user logon; a common design uses machine auth for imaging and user auth for interactive sessions, with a machine/user timeout.

RADIUS attributes that matter: User-Name (1), NAS-IP-Address (4), Called-Station-ID (30, AP MAC:SSID), Calling-Station-ID (31, client MAC), Tunnel-Type (64), Tunnel-Medium-Type (65), Tunnel-Private-Group-ID (81, VLAN).

RADIUS shared secret authenticates the NAS to the server; it is not a user credential and must be long and unique per NAS, rotated on schedule.

RADIUS accounting uses Start/Interim-Update/Stop records; the Acct-Session-Id correlates sessions, and interim updates at 5-15 minutes bound log loss.

EAP over RADIUS: the authenticator relays EAP-Message (79) attributes; Message-Authenticator (80) must be present to prevent EAP-Message injection (Blast-RADIUS-class flaws).

RadSec (RADIUS over TLS, TCP 2083) protects the NAS-server path when it crosses untrusted networks; standard RADIUS is UDP 1812/1813.

Server certificate requirements: the CN/SAN must match the name clients are configured to validate; clients must trust the issuing CA and check EKU serverAuth.

Private CA design: offline root, issuing CA for RADIUS/AP server certs, separate template for client certs; CRL or OCSP must be reachable or clients fail closed.

Certificate lifetime and renewal: short-lived server certs (e.g., 1 year) reduce exposure; expired RADIUS server certs cause mass authentication failures, so monitor expiry.

WIDS detects policy violations (rogue AP, evil twin, deauth flood, spoofed MAC); WIPS adds containment (deauth or wired-port blocking) and must be legally authorized before enabling.

Rogue AP classification: authorized (known MAC/BSSID), neighbor (known external), interfering, or rogue (unknown on the corporate wire); wired-side correlation via switch MAC tables confirms on-network rogues.

Monitor-mode capture on a dedicated sensor radio is required for full-channel visibility; a single radio scanning N channels sees each channel roughly 1/N of the time.

Key detection signatures: deauth/disassoc rate per BSSID, beacon with mismatched BSSID/SSID vs authorized inventory, PMKID/EAPOL handshake bursts, and high retry rates indicating jamming.

Incident response phases for WLAN: preparation, detection/analysis, containment (block MAC, disable port, rotate PSK), eradication (patch, rekey), recovery, and lessons learned.

Containment caution: deauth-based containment can disrupt legitimate clients and may violate RF regulations; prefer wired-port shutdown when the rogue is on the corporate LAN.

Evidence handling: capture pcap with timestamps from a trusted clock, hash the capture, and preserve RADIUS accounting logs; chain of custody applies to network evidence.

Post-incident PSK rotation: after PSK disclosure, changing the passphrase does not invalidate already-derived PMKs, so force reauthentication and consider SAE migration.

Guest isolation: separate SSID, separate VLAN, ACL blocking RFC1918 corporate subnets, and client isolation (AP isolation) to prevent guest-to-guest traffic.

Guest onboarding patterns: open SSID + captive portal with click-through (low assurance), sponsored access, or self-registration with email/SMS verification; all should use HTTPS portals.

BYOD onboarding: 802.1X with user credentials or certificate enrollment (SCEP/EST) after device posture check; EAP-TLS with per-device certs is the strongest option.

Device provisioning: DPP or onboarding SSID with limited lifetime is preferred over static PSK; WPS PIN must be disabled because of the brute-force weakness.

NAC/posture: check OS patch level, AV presence, and encryption status before granting corporate VLAN; noncompliant devices land in a remediation VLAN.

Bandwidth and QoS: rate-limit guest SSIDs, cap per-client throughput, and place guest traffic on a lower QoS tier to protect business applications.

Guest network segmentation should be enforced at the firewall, not only at the SSID; verify with a port scan from the guest VLAN to corporate subnets.

BYOD privacy: MDM/MAM should limit collection to corporate data containers; a clear policy on remote wipe scope (container vs whole device) is a design requirement.

Policy elements: approved SSIDs and encryption minimums (WPA2-Enterprise or WPA3), prohibited configurations (WEP, TKIP, open), and exception process with expiry.

PCI DSS: wireless in cardholder scope requires strong cryptography, unique keys, and quarterly (or after change) scans by an ASV; rogue AP detection is required for CDE wireless.

HIPAA Security Rule maps to WLAN controls via access control (§164.312(a)), transmission security (§164.312(e)), and audit controls (§164.312(b)).

NIST SP 800-153 provides WLAN security guidelines: configuration standards, monitoring, and lifecycle management; SP 800-97 covers 802.11i enterprise deployment.

ISO/IEC 27001 Annex A controls for wireless: A.8.20 (network security), A.8.21 (security of network services), A.5.15 (access control); map SSIDs to these in the SoA.

Password/PSK policy: minimum 20 characters for WPA2-PSK (PBKDF2 makes short PSKs cheap to crack offline), rotation on staff departure, and storage in a vault.

Baseline hardening: disable WPS, disable Telnet/HTTP management on APs, use SNMPv3, restrict management to a dedicated VLAN, and enable PMF where supported.

Audit cadence: quarterly wireless scans, annual policy review, and post-change verification; retain RADIUS logs per retention policy (commonly 1 year).