CWSR study plan
CWSR · Give each week a clear focus.
8 weeks · About 7 hours per week
WLAN Security Fundamentals and Risk Assessment
Define the core WLAN threat categories (eavesdropping, rogue AP, evil twin, deauthentication, on-path) and write a one-line business impact statement for each.
Explain how the CIA triad maps to specific 802.11 weaknesses, including open authentication, shared key, and unencrypted management frames.
Perform a risk assessment on a hypothetical small-office WLAN using likelihood and impact scoring, then rank the top five risks.
Distinguish between vulnerability, threat, and risk using WLAN examples so the terms are not conflated on scenario questions.
Your checkpoint
A one-page risk register with at least eight WLAN risks scored for likelihood and impact, plus a ranked top-five list with a one-sentence mitigation each.
WLAN Security Fundamentals and Risk Assessment & 802.11 Security Architecture and Frame Protection
Describe the 802.11 frame types (management, control, data) and identify which frames are unprotected in each security generation.
Diagram the 802.11 state machine from unauthenticated and unassociated through authenticated and associated, noting where security exchanges occur.
Explain how 802.11w management frame protection (PMF) protects deauthentication, disassociation, and action frames, and what breaks without it.
Compare open system and shared key authentication and explain why shared key authentication weakens security.
Your checkpoint
A hand-drawn or digital state-machine diagram with annotated frame types and a short written note on where PMF applies and where it does not.
WPA, WPA2, WPA3 and Robust Security Networks
Contrast WPA, WPA2, and WPA3 across encryption cipher, integrity method, key management, and handshake, including TKIP, CCMP, and GCMP.
Trace the WPA2 four-way handshake step by step and explain how the PMK, PTK, ANonce, SNonce, and MIC fit together.
Explain WPA3-SAE, forward secrecy, and the dragonfly exchange at a conceptual level, and why SAE resists offline dictionary attacks.
Identify WPA3 transition mode behavior and the downgrade risks it introduces.
Compare personal and enterprise modes and state when each is appropriate.
Your checkpoint
A comparison table of WPA, WPA2, and WPA3 covering cipher, integrity, handshake, key length, and known weaknesses, plus a numbered four-way handshake walkthrough.
WPA, WPA2, WPA3 and Robust Security Networks & 802.1X Authentication and EAP Methods
Map the 802.1X roles (supplicant, authenticator, authentication server) and the controlled and uncontrolled ports to a real enterprise WLAN.
Sequence the EAP exchange from EAPOL-Start through EAP-Success and the subsequent key derivation.
Compare EAP-TLS, EAP-TTLS, PEAP, and EAP-FAST on server certificate requirements, client certificate requirements, and inner-method exposure.
Explain why PEAP without server certificate validation enables an evil-twin credential harvest.
Your checkpoint
An 802.1X message-flow diagram from EAPOL-Start to key installation, with a table comparing at least four EAP methods on certificate needs and tunnel properties.
802.1X Authentication and EAP Methods & RADIUS, PKI and Certificate Infrastructure
Describe RADIUS accounting and authorization attributes (for example, tunnel attributes and VLAN assignment) and how they influence WLAN policy.
Explain RADIUS shared secrets, message authenticator, and why RADIUS should be tunneled or protected in transit.
Outline a PKI hierarchy (root, intermediate, issuing CA) and the role of certificate revocation via CRL and OCSP in 802.1X.
Describe how to enroll and validate a server certificate for EAP so clients can trust the authentication server.
Identify common PKI failure modes in WLAN deployments, such as expired certificates and missing CA trust on clients.
Your checkpoint
A PKI and RADIUS architecture diagram showing CA hierarchy, RADIUS server, authenticator, and supplicant, with a checklist of certificate validity and revocation checks.
WLAN Monitoring, Intrusion Detection and Incident Response
Explain WIDS and WIPS functions, including rogue AP detection, evil-twin detection, and deauthentication flood detection.
Describe how rogue AP classification works using wired-side correlation and why false positives occur.
Draft an incident response sequence for a detected rogue AP, from triage through containment and post-incident review.
Identify the log sources and metrics that support WLAN security monitoring.
Your checkpoint
A one-page incident response runbook for a rogue AP detection, including triage steps, containment actions, escalation, and evidence to preserve.
Secure Guest, BYOD and Guest Network Design & Wireless Security Policy, Compliance and Best Practices
Design a guest network that isolates guest traffic from internal resources using VLANs, ACLs, and client isolation.
Compare guest access models (captive portal, sponsored access, self-registration) and state the security tradeoffs of each.
Draft BYOD onboarding controls covering device posture, certificate-based onboarding, and separation of personal and corporate data.
Summarize the policy elements a WLAN security standard should contain, including password policy, key rotation, and acceptable use.
Your checkpoint
A guest and BYOD network design brief with a segmentation diagram, access control rules, and a list of onboarding controls.
Wireless Security Policy, Compliance and Best Practices & WLAN Security Fundamentals and Risk Assessment
Assemble a compliance checklist mapping WLAN controls to common frameworks such as PCI DSS wireless requirements and general least-privilege practices.
Review the full domain list and close knowledge gaps by re-testing the weakest two domains.
Practice scenario-based questions under timed conditions and analyze every wrong answer for the underlying concept.
Write a personal post-exam action plan for keeping WLAN security knowledge current.
Your checkpoint
A timed 60-question practice set with a written error log explaining the root cause of each miss and the concept to review.
Milestones
Week 2: Can explain the 802.11 state machine and name which frame classes are unprotected without PMF, without notes.
Week 4: Can draw the 802.1X and four-way handshake flows from memory and state the certificate requirements of four EAP methods.
Week 6: Can describe rogue AP detection and containment steps and produce the incident runbook from memory in under 15 minutes.
Week 8: Scores at least 80 percent on the timed 60-question practice set with a complete error log.