Well, it's time to move on to talk about wireless security.
And we want to start by identifying the reasons why security is such a big deal
in the wireless
world.
And so much of it has to do with our RF propagation, our radio frequency, the
fact that when we
communicate with wireless, it goes everywhere.
A lot of times when we are first learning wireless, we might draw a diagram
like this,
or we say there's a user down here, maybe they have a phone or a tablet or even WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or we say there's a user down here, maybe they have a phone or a tablet or even
a laptop
here.
And we like to draw these lines like it's communicating with the access point.
In fact, I've been using these lines to represent wireless communication
throughout this skill.
And it makes it look like it's very linear, or communicating back and forth
like this.
But that's not what actually is happening.
When we think about RF, it's going to go out and radiate in a 360 degree
pattern depending
a little bit, or a lot of it, on the antennas, depending on which antennas we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a little bit, or a lot of it, on the antennas, depending on which antennas we
've deployed.
So when we talked about antennas earlier on, we talked about these being omnid
irectional
antennas.
And when we look at omnidirectional antennas from above, I can put an access
point here
on, let's say, a floor map.
Now we're looking at the plans for our building, so we've got rooms in here and
hallways and
so on and so forth.
And now all of a sudden we've got this access point that's sort of in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now all of a sudden we've got this access point that's sort of in the
hallway here.
And when we look at the wireless propagation, it goes out radially all the way
around it.
Now I'm not drawing perfect circles, but we probably get the point.
I might have my user over here, and that user is down here in this room.
And so I might think that I'm communicating directly with this access point.
But in order for the access point to communicate with the user in this
direction, it's also
going to have to send that same signal this direction and out into the parking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to have to send that same signal this direction and out into the parking
lot.
And over to this office, or maybe it's a waiting room where we have guests
sitting around.
And so we see the problem right away.
The propagation of our RF means that our signals just go everywhere.
It's easy for them to find recipients and users.
Maybe there's a user in here with a wireless device, and they're going to get
that communication.
And for that matter, maybe we have threat actors who are hanging out in the
parking lot, and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
parking lot, and
they have a laptop.
And now their laptop is receiving the wireless signal that was intended to be
received by
somebody on the opposite side of the building.
Sometimes this is beneficial because I might want wireless communication from
this access
point to be received in all of these different office spaces.
However, it can also be harmful to us because again, it makes it so threat
actors now have
access to our wireless communications.
So we have two concerns with all of this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we have two concerns with all of this.
First of all, we need to think about wireless access control.
We're probably immediately going to think about wireless encryption and we'll
get to
that, but access control is very important.
What's stopping this threat actor from actually using this access point to gain
access to
the rest of our network?
Well, that's problematic because if this was a wired scenario, the threat actor
would
somehow have to end up inside one of these buildings and plug into the wall and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
somehow have to end up inside one of these buildings and plug into the wall and
then
ride the ethernet cables to wherever there's the nearest switch.
That's what would be required for wired communication access.
And so we hope that the physical security of the building, namely how did they
get into
this space that that would help us to prevent them from accessing our wired
network.
But now that we're wireless, in the same way that this access point is sending
signals
such that the threat actor can receive them, well, the threat actor can send WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
such that the threat actor can receive them, well, the threat actor can send
signals back
to the access point and the access point can receive it and the threat actor
never had
to leave their car out in the parking lot.
And so access control is just as big of a deal as some of our privacy concerns.
So how do we prevent access from an unauthorized person?
Well, we're going to use some of the same mechanisms, really similar mechanisms
that
we use on the wired side.
And especially we want to use the concept of authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And especially we want to use the concept of authentication.
We think about authentication.
This is claiming who I am in such a way that I can prove who it is that I claim
to be.
So it's not just me saying that I'm the CEO or maybe even some other staff
member.
It's also going to require proof.
Now there's a lot of different methods for proving my identity.
For example, a lot of us just use a username and password combination.
And this is starting to feel a little bit archaic in the modern network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is starting to feel a little bit archaic in the modern network.
For example, we can use elements such as multi-factor authentication, sometimes
texting
a number, you know, some kind of authentication number to our phone, a one-time
password.
So that's OTPs here, this one-time password concept that says, "Hey, here's a
six-digit
ID that will let you log in."
I can sometimes not even have to worry about a text message.
I could use a multi-factor authentication app to perform this exact same
operation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
operation.
We can also use certificates.
Certificates would be loaded onto a machine.
So they take a little bit more work to get it to function.
But if I have a laptop or a mobile device, I can place a certificate onto the
device.
But in theory, the hope is that this certificate being on this device proves
that it belongs
to a specific user.
And so some combination of these are probably what we're going to consider for
deploying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
deploying
to a wireless network, but it all relates back, again, to our authentication,
improving
that I am who I claim to be.
Namely, or in this situation, if this user down here, user A and user B are on
the network,
I can claim, wirelessly, I suppose here, I can claim to be user A or user B for
that
matter.
But if I don't have these elements, I can't actually authenticate and the
network is going
to reject that access attempt.
So we're keeping the bad guys. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're keeping the bad guys.
We're keeping these threat actors off of our network, even though they have
access via wireless
communications.
The other concept that we need to worry about, and this one is very important,
is what would
refer to as privacy.
The primary mechanism we'll use to combat privacy is encryption.
When we talk about privacy, what we really are concerned with is the concept of
listening
in, or eavesdropping, maybe we might call it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in, or eavesdropping, maybe we might call it.
So listening in means that, again, I might want to communicate here to this
access point.
I've got my laptop and there's a threat actor out in the parking lot listening.
So again, I might think that I'm doing this with my wireless communications,
but the reality
is that sending to the access point means that I'm sending radially out.
So cool, the access point does receive my communication.
Not so cool.
So does the threat actor.
They both receive my communication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They both receive my communication.
They can both listen in and that's good for the access point and not good for
the threat
actor.
And so this is where we'd want to use some kind of means of protecting my
communication
and encryption is nothing new and as far as network security is concerned.
However, again, when we relate this back to the wired network, we don't use a
whole
lot of encryption between wired stations and wired clients.
And the reason for that is simply for a threat actor to listen in on a wired
communication,
they would actually need access to that in some capacity, either in some way WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they would actually need access to that in some capacity, either in some way
inserting
themselves into the middle of that communication or possibly using something
more sophisticated
to listen in on what's happening on that wire.
But it does still require physical access when we're talking about wired
communications.
Wireless communications are going to rely on encryption even more so than with
wired
communications that occur on the network.
And this will make it so whatever sensitive information that I'm sending won't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this will make it so whatever sensitive information that I'm sending won't
be able
to be properly received by the threat actor because they'll still hear the
signal that
comes in, they can still listen into the signal, but now that signal is
scrambled by my encryption.
And in theory, they have no way to unscramble or decrypt that.
Now we're going to talk about various encryption methods here.
And there are methods that we might use on the enterprise side versus at home
that will
make it even harder to decrypt it.
But we do need to recognize that there are limitations to some of these methods WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we do need to recognize that there are limitations to some of these methods
that
are pretty common out there, especially pre shared keys.
But either way, let's go ahead and move into a little bit more details around
this.
But we just wanted to kind of lay the groundwork of saying that we care greatly
about addressing
access control and privacy and any security mechanisms that we propose are
going to ideally
address both of these.
But we might find that some of them address one and not the other.
[BLANK_AUDIO]