When the security assessment or the client makes a safety assessment, one problem becomes more frequent: can your wireless network protect against fishing APs? The background to this is that in recent years the proportion of wireless networks as initial entry points has been rising. The attackers do not need physical access to buildings, no break-through, and it is possible to lure tickets from businesses by placing a fishing AP near their building under the name SSID, along with a low cost social worker's "wire network is broken and please recertification" means. The staff saw the familiar SSID name, entered a password, and there was no apparent unusual hint, but the actual authentication request was intercepted by the assailants.——The path to the attack is not technically high, and open-source tools can be built in hours, but it has been achieved in cases where there is insufficient training on corporate security awareness. This scenario is technically real and not uncommon in reality, but many businesses do not put this threat model into their assessment dimensions when they choose wireless certification systems, and there is a clear gap between security assessments and procurement decisions.
The company wireless certification system for fishing APs is dependent on what authentication structure it uses, a judgement that is crucial and cannot be said in general terms. If WPA2-Enterprise plus 802.1X is used, each connection is validated by the RADIUS server, AP itself is only bridged without participation in certification decisions, and the attackers ' forged AP can send SSID with the same name but cannot provide a real RADIUS server to respond to certification requests.——The server is to verify the client, the client is also to authenticate the server, the attacker cannot fake the server response without the real RADIFUS private key, and certification fails. From this perspective, 802.1X has a natural structural advantage in anti-fishing APs, which are built-in capacity at protocol level and do not rely on additional security functions. The rationale is clear, the effects are real, but it is conditional upon the customer properly configured and validated the server certificate.
A key prerequisite is that the client must properly configure root certificate authentication, which is not a safe environment. In the PEAP certification process in WPA2-Enterprise, the client connects to authenticate certificates from RADIUS servers and only continues if the certificate is issued by trusted CA or it refuses to do so directly. The design itself is safe, but there are many problems in practice: if the enterprise does not deploy an internal CA, it uses a self-signed certificate, and when the employee terminal first connects, it gives a warning that is untrustworthy. Most employees simply "continue to ignore this warning" and then write this extra-regulation rule on the end, and they won't play again next time.——This action has the security value of certifications at zero. More importantly, many enterprises have wireless terminal configurations where root certificates are automatically closed when they are issued under IT, because it is opened to manage the chain of release and updating of CA certificates, adding workload. The integration firm will not take the test on its own initiative, nor will it separately list the details of the configurations at the time of acceptance.——This configuration gap is real and offsets the server-end authentication advantage of 802.1X by a high frequency loss component at the time of security assessment.
** The second threat scenario that wireless certification can protect itself from is the horizontal penetration of the inner net.** One of the core security values of Wireless Certification for Business is dual identification of users and equipment, with a documented physical threshold at the access level. Even if the attackers get an active account through fishing WiFi or other means, it will be harder to move laterally in the net than in a wired environment because 802.1X, combined with a reasonable VLAN division, allows terminals connected by wireless access only to their respective network areas and not directly scan high-value segments such as finance, research and development, core operations etc. Wireless access has changed the border from "to plug in" to "to authenticate access to VLAN, which is not available on a network and is the most important value export for wireless certification at the security level. When government clients do security construction, they tend to buy firewalls and intrusion detection devices at a high cost, while ignoring the most basic network access control. In practice, access is poor, the threshold for attackers to enter the inner net is low, and the firewall is thicker than anyone already standing in the door.
But authentication is not a access control, which is two different things. It must be understood separately. The certification solves the question of "Who are you?" and the access control resolves the question of "What can you do," both at different levels in the security architecture. Many companies have agreed to secure the inner net after they have gone on wireless certification systems, believing that access has been closed down for the entire system. This is the biggest area of perception. Wireless access is only the first door to a safe border, and then, after that, can there be an exchange of access between terminals within VLAN, whether there is an ACL segment separation between networks, whether there is an independent firewall strategy for key operations?——These are access controls, not functional areas that wireless authentication systems can cover themselves. Assessment of the security capabilities of wireless certification systems cannot be seen only in terms of how robust they are but also in terms of their integration with existing network security architecture: which VLAN is the default for the approved endpoint, who is the contact control strategy between VLAN and other VLANs and whether the process of change is manageable.——The answers to these questions reflect the overall safe water level more than the certification agreement itself.
Three things are needed to ensure that the security risk of wireless access is brought to an acceptable level: a robust certification mechanism is the basis, with no 802.1X plus certificate confirming the base, and controls on the upper layers are built on sand; the second layer is sophisticated access control in the network layer, VLAN divides 802.1Q labels, certified terminals fall into different segments by sector, role by role, and inter-portal controls between terminals within the same section. The third level is continuous end security monitoring, radio access terminal abnormal behaviour detection, such as extensive scanning of inner network sections at multiple locations for short account hours after authentication and terminal access——These behavioral features reflect the intent of attack more accurately than authentication itself. Wireless certification systems are the cheapest and fastest-built layer in these three layers, which is the basis for this, but it is considered to be the only means by which the greatest security error can occur, and it is only a matter of time before they are penetrated when the insurance evaluation is carried out.