Most of us who have set up wireless networks even at home are probably familiar
with the
concept of WPA, which stands for Wi-Fi protected access.
WPA at the time of this video has three different versions, and the original W
PA we definitely
don't want to use anymore.
These days it's between WPA2 and WPA3.
Now in modern enterprise networks, we should absolutely be either deploying or
migrating
towards WPA3, although the reality is that until we migrate all of our hosts WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
towards WPA3, although the reality is that until we migrate all of our hosts
off of WPA2,
there's going to be this intermediary period where we have to either run both
or WPA3 and
backwards compatibility mode and so on and so forth.
But just leaving the version conversation behind, either way, when we're
looking at WPA, we
have two different versions that we should be aware of.
We have a personal version which is intended to be used for those small office,
home office
type deployments, basically a scenario where we don't have a robust WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
type deployments, basically a scenario where we don't have a robust
infrastructure that
can, you know, like radius and tack act servers and these kinds of things,
which can improve
our security but requires not only infrastructure but also expertise around it.
And then we have enterprise, which as we might imagine is going to have all of
those
different features.
So these are intended as the name implies for enterprise types of networks.
So let's go ahead and dive into this and understand what the difference is and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go ahead and dive into this and understand what the difference is and
when
we would want to use one over the other.
And we kind of already implied, hey, if we have a small office, home office,
just my
residential Wi-Fi, what I use here in the house, I'm probably going to use WPA
personal,
whereas all of our enterprises should be using enterprise.
We should not be deploying personal into our companies and corporate networks,
but I will
say that I have certainly seen it as I imagine a lot of us have.
So either way, when we're talking about personal, we are talking about the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So either way, when we're talking about personal, we are talking about the
concept of a pre-shared
key, otherwise known as a PSK.
The pre-shared key is somewhat notorious in all of our WPA configurations.
It is both very simple, very, very simple to deploy, a whole lot easier than
anything
else that we might consider for wireless security.
However, it also is going to come with scaling challenges. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, it also is going to come with scaling challenges.
Oops, like that.
So we don't scale very well.
However, it is nice and simple, which is why it works great at home.
The idea here is we basically have a single shared, right there in the word, a
single
shared password.
So if I show up at a cafe and they have a sign up that says, "Hey, we have free
Wi-Fi
and here's the password, this is the pre-shared key."
So now I have the pre-shared key and therefore I can use it both for two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now I have the pre-shared key and therefore I can use it both for two
different reasons
here.
And this is kind of interesting.
I can use it for authentication and I can use it for encryption.
Now, what do we mean by this?
Well, remember what we just said in the previous video.
Anytime we're talking about wireless security, we need to think about it from
an authentication
perspective and we need to think about it from an encryption perspective.
A pre-shared key combines both of these concepts and puts it all on this one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A pre-shared key combines both of these concepts and puts it all on this one
key.
What I mean by that is remember with authentication, it's basically proving who
I use.
I say I am, but it's proving that I deserve access, that I belong on the
network.
Well, how do I prove I belong?
Well, I prove it simply by saying that I have the pre-shared key.
Now, yeah, if I go to a cafe, we're all handing out the pre-shared key.
But if I think about my home Wi-Fi, for example, I have a pre-shared key WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But if I think about my home Wi-Fi, for example, I have a pre-shared key
configured and I don't
just advertise it to everybody.
My neighbors couldn't use my Wi-Fi because they don't know what my PSK is.
However, well, as we'll talk about here in a moment, there are challenges still
with PSKs
and the fact that maybe people do have my pre-shared key.
And at that point, what does that mean for my security?
The other thing is encryption.
So the encryption is going to leverage the PSK to form my encryption keys. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the encryption is going to leverage the PSK to form my encryption keys.
Now, to be clear, the PSK is not an encryption key.
It just allows me to authenticate and then get the encryption keys by using the
pre-shared
key itself.
This also creates an interesting situation.
So let's go through the problem with this.
We see the benefit.
The benefit is this is very simple.
If I have a guest show up at my home, I can give them the PSK.
They have the PSK, they can get on to my Wi-Fi, they prove they belong, they WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They have the PSK, they can get on to my Wi-Fi, they prove they belong, they
use it for encryption,
life should be good from that perspective.
But there are some major downsides to my pre-shared key from a scaling
perspective.
And when I think about scaling, hey, I'm thinking about enterprise networks.
Remember, scaling is very, very important when we're talking about enterprise
networks.
So we have some scaling concerns here with pre-shared keys. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we have some scaling concerns here with pre-shared keys.
First and foremost, keep in mind that a pre-shared key is sort of everything
all in one.
It's my authentication, it's my encryption, which means that if I have the pre-
shared
key and I'm talking to an access point, but you also have the same pre-shared
key and
you're using this to encrypt your traffic, I can listen into this and I can
decrypt your
traffic.
We both have the same key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We both have the same key.
We are both capable of decrypting one another's traffic because of this pre-
shared key concept.
Now this does change with WPA3.
It's one of the reasons why we want to go over to WPA3.
There are additional protections in place, but with WPA2, this is absolutely a
concern
that I can simply listen in to your communications and I can decrypt them using
the same pre-shared
key that we both have. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
key that we both have.
The other problem is managing access.
This is a major scaling problem.
You say, "Well, wait a second, this is easy to manage access.
I just give out the pre-shared key to anybody who wants it."
Sure, that works well.
But how do I revoke access to my wireless network?
I've just given out the pre-shared key and I've got in my house, for example,
let's say
I've got like 30 wireless devices and they all have the same pre-shared key.
Again, this works great in my house. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, this works great in my house.
But now let's say I give my pre-shared key to my neighbor so that they can use
the Wi-Fi
while they're over at my house.
Well now my neighbor is over in their house and they still have my pre-shared
key, meaning
they can continue to access my Wi-Fi from their own home in all likelihood.
So how do I revoke that access?
The only thing I can do is change it to go from pre-shared key one to pre-
shared key
two and yet think about all of the implications of that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
two and yet think about all of the implications of that.
I have to go to all of these other 30 devices and change the pre-shared key to
something
new, just to prevent this one user from accessing my network.
Well, this is going to apply to our enterprise networks as well.
Again, think about it from a scaling perspective in terms of whether or not I'd
want to deploy
this into a corporate network.
This is one of the major reasons why we wouldn't want to do that because
essentially in the
event that this gets compromised and a compromising event could be as simple as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event that this gets compromised and a compromising event could be as simple as
one of my account
managers quits and leaves and they know the pre-shared key because they've had
to put
it onto their laptop so many times.
Well that employee who just left knows our security key for our wireless and so
I can't
revoke them, the revoke their access, I am going to instead have to change the
pre-shared
key.
So this is one of the main ways that it does not scale for enterprise
deployments.
So at the end of this conversation we see that the pre-shared key is great from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So at the end of this conversation we see that the pre-shared key is great from
a personal
perspective even though it does still apply some challenges here like I just
said, hey
anybody I give the pre-shared key to, they've got more or less permanent access
to my home
network but at least it doesn't require a whole lot of infrastructure and
architecture.
So let's go and talk about enterprise WPA.
This is what we should be deploying into our corporate networks.
The WPA enterprises introduces a new concept here of 802.1x using that as well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The WPA enterprises introduces a new concept here of 802.1x using that as well
as what
we call EAP and we'll talk about EAP here in a moment.
But 802.1x and EAP specifically these are going to split the concept here of
our encryption
and our authentication.
Meaning that I'm not going to be able to use the same mechanism to both authent
icate and
encrypt, these are going to be different. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
encrypt, these are going to be different.
There's this wall that's built between the two.
So the idea here is that when I first authenticate to the network, to the
access point, I'm going
to try to connect to this and I'm going to use an 802.1x mechanism for doing so
.
We have a lot of different options and those options are provided by EAP.
Meaning I can provide a username or an password or I can do a certificate or
any of the other WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
any of the other
options that we talked about.
So I've got a lot of different options for authenticating but none of this
provides an
encryption key.
Once I have authenticated, then I go into an encryption mode where I say, "Okay
, now
it's time for us to create encryption keys."
And we can perform a secure process known as a Diffie-Hellman key exchange here
and this
key exchange is going to give us a set of keys that we can use to encrypt our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
key exchange is going to give us a set of keys that we can use to encrypt our
traffic.
And importantly, this is going to be different on a per station basis.
Meaning that the encryption keys that I use will be different than the
encryption keys
that somebody else is using even though we're both connected to the same access
point.
So that's awesome but here's the downside.
802.1x and EAP, this is going to require a radius server or maybe a takx plus
server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
server.
It's going to require some advanced configuration.
I might have to use certificates.
I might have to set up users and user accounts.
But if we think about it from that scaling perspective, well now I can go in
here because
I have a directory service and I can revoke access.
This issue here is now gone because I can make it so whatever we're using over
here from
a username, password, certificate, perspective, I can go into my infrastructure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a username, password, certificate, perspective, I can go into my infrastructure
and say, hey,
that account manager who just left no longer allow them to access the network.
So even though they maybe took their laptop home, whether they were supposed to
or not,
I don't know, but even though they took it home, if they were to drive back to
the parking
lot and try to connect to the wireless, whenever they tried to authenticate,
the access point
is going to reject that attempt because they have been revoked from or they've
been removed
from our infrastructure, from our directory service.
And so the good and bad of this is, hey, great, we've got the scaling. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so the good and bad of this is, hey, great, we've got the scaling.
Unfortunately, it requires a lot of infrastructure and expertise on how to
manage that infrastructure,
which is why it's an enterprise solution.
But we do see that it tackles some of the concerns and the problems with WPA
personal, especially
as it relates to trying to deploy that into a corporate network.