CWSR key terms

An unauthorized access point connected to a wired network, often by an employee or attacker, that can bypass perimeter controls and expose internal resources to wireless clients. Detection relies on RF scanning and wired-side correlation.

A malicious access point that imitates a legitimate SSID to lure clients into associating with it, enabling credential capture or traffic interception. Defenses include server certificate validation under EAP and WIDS alerts on duplicate SSIDs.

A structured process that identifies wireless assets, enumerates threats and vulnerabilities, and estimates likelihood and impact to prioritize controls. Outputs typically feed a risk register and remediation roadmap.

A design-time exercise that maps data flows and trust boundaries in a WLAN architecture, then enumerates plausible attacks such as over-the-air sniffing, deauthentication, and credential theft so controls can be chosen deliberately.

The human-readable network name broadcast in beacon and probe response frames. It is not a security control; hiding it provides negligible protection because the value appears in other management and association frames.

A configuration that omits the network name from beacon frames. Clients still transmit the name in probe requests, so it is a weak obscurity measure and not a substitute for strong authentication.

The 802.11 authentication algorithm that accepts any station without verifying identity. It establishes association only and must be paired with a higher-layer mechanism such as WPA3 or 802.1X for actual access control.

An 802.11 network that uses the 802.11i security amendments, requiring 802.1X authentication or a pre-shared key plus AES-based encryption for unicast traffic. Association to an RSN is negotiated through the RSN information element.

A field carried in beacon, probe, and association frames that advertises supported cipher suites, authentication key management options, and capabilities. Stations and access points use it to negotiate a mutually supported security policy.

A named combination of encryption and integrity algorithms, such as CCMP or GCMP, advertised in the RSN information element. Mismatched or downgraded suites can weaken the link or cause association failure.

The AES-based encryption and integrity protocol defined in 802.11i, replacing TKIP. It uses counter mode encryption with a cipher block chaining message authentication code and is mandatory for WPA2 certified equipment.

An AES-GCM based cipher suite introduced for higher throughput and stronger integrity, mandatory in Wi-Fi 6 and used by WPA3 and Protected Management Frames. It provides authenticated encryption in a single pass.

A legacy cipher that wrapped WEP with per-packet key mixing and a message integrity check. It is deprecated and disallowed by WPA3 because of known weaknesses, though it may appear in older mixed-mode configurations.

An interim certification created before 802.11i was ratified. It retained RC4 with TKIP and added a message integrity check, and it is now considered obsolete for enterprise use.

The certification aligned with full 802.11i, requiring CCMP and supporting both personal pre-shared key and enterprise 802.1X modes. It remains widely deployed but lacks protections against offline dictionary attacks on passphrases.

The successor certification that mandates Simultaneous Authentication of Equals for personal mode, Protected Management Frames, and stronger enterprise requirements. It resists offline guessing of captured handshakes.

A password-authenticated key exchange used in WPA3-Personal that derives a shared key without exposing material usable for offline guessing. It also provides forward secrecy for session keys.

The exchange that confirms both parties possess the pairwise master key and derives fresh session keys. Capturing it enables offline passphrase guessing against WPA2-Personal networks.

A shared secret derived from the pre-shared key or from 802.1X authentication results. It seeds the four-way handshake and never crosses the wireless medium directly.

An 802.11w feature that adds integrity protection to certain management frames such as deauthentication and disassociation, preventing spoofed disconnect attacks. It is required for WPA3 certification.

An attack that forges deauthentication or disassociation frames to drop clients off the network, often to force reconnection through an evil twin or to capture handshakes. Protected Management Frames mitigate it.

A port-based network access control framework in which a supplicant authenticates through an authenticator to a backend authentication server before the controlled port opens. It underpins enterprise WLAN authentication.

The client-side 802.1X component that responds to authentication requests, typically implemented in the operating system or a third-party client. It holds the credentials or certificates used during EAP exchange.

The network device that enforces 802.1X, relaying EAP messages between supplicant and authentication server and opening or blocking the controlled port based on the result. In a WLAN this is the access point or controller.

An extensible framework for authentication exchanges that carries method-specific conversations between supplicant and server. EAP itself defines no security; the chosen method determines the actual strength.

An EAP method requiring certificates on both client and server, providing strong mutual authentication and resistance to password theft. It is demanding to operate because every client needs a valid certificate.

A tunneled EAP method that establishes a TLS tunnel using a server certificate, then authenticates the user inside it, commonly with MS-CHAPv2. Clients must validate the server certificate to avoid credential capture.

A tunneled EAP method using a protected access credential instead of a public key certificate to build the tunnel. It reduces PKI dependency but requires secure provisioning of the credential.

A AAA protocol that carries authentication, authorization, and accounting attributes between a network access device and a central server. In WLANs it terminates the EAP conversation and returns accept or reject decisions.

A preconfigured value used to authenticate and integrity-protect communication between a RADIUS client and server. Weak or reused secrets allow forged accounting or authentication traffic.

A typed value carrying authorization or accounting detail, such as tunnel parameters, VLAN assignment, or session metadata. Attribute handling must be validated because clients and servers interpret them differently.

A technique where the RADIUS server returns tunnel attributes that place a user into a specific VLAN after authentication. It enables role-based segmentation without separate SSIDs.

A trusted entity that issues and signs digital certificates binding public keys to identities. In WLANs it enables server identity validation for tunneled EAP and mutual authentication for EAP-TLS.

A client configuration that restricts which server certificate or CA is acceptable during EAP, preventing acceptance of an attacker's certificate. It is a key defense against evil twin credential capture.

A wireless intrusion prevention system that continuously monitors RF for policy violations and attacks, then can take automated countermeasures such as containing a rogue device. It complements, but does not replace, wired-side controls.

A wireless intrusion detection system that passively collects and analyzes wireless traffic and RF data to alert on anomalies such as spoofed frames, unusual associations, or unauthorized devices. It detects but does not automatically block.

A documented sequence of preparation, detection, containment, eradication, recovery, and lessons learned tailored to wireless incidents. It assigns roles and defines evidence handling before an event occurs.

A web-based interception mechanism that redirects clients to a page for acceptance of terms or credential entry before granting access. It provides weak identity assurance unless combined with stronger authentication.

A design in which guest traffic is separated from internal networks by VLANs, ACLs, or a dedicated firewall zone, allowing internet access only. It limits lateral movement from untrusted devices.

A process for enrolling employee-owned devices through registration, certificate provisioning, and policy acceptance so they can access approved resources. It typically relies on MDM or certificate-based identity.

The practice of dividing a WLAN into separate logical networks with enforced policy boundaries between them. Segmentation limits blast radius and supports role-based access for guests, employees, and devices.

A management document defining approved wireless configurations, roles, device standards, monitoring duties, and exception handling. It gives technical controls an enforceable basis and is reviewed on a defined cycle.

A periodic evaluation that verifies wireless configurations and operational practices against internal policy and external requirements such as PCI DSS. Findings are tracked to closure with owners and dates.