Security Operations · Topic 2 of 13
Wireless and Mobile Device Security
Security+ wireless and mobile security: site surveys, WPA2 and WPA3, 802.1X enterprise Wi-Fi, MDM features, and the BYOD, COPE and CYOD device models.
- 4 min
- A site survey and heat map guide access point placement.
- WEP and WPA are weak. WPA2 is common, and WPA3 is the current standard.
- WPA3 personal uses SAE to resist offline password guessing.
What it is
Wireless networks and mobile devices extend the network beyond the building and put company data in people's pockets. Both need planning of the radio environment, strong protocols and central control.
This page covers how to plan and secure Wi-Fi, which protocols to choose, and how mobile devices are managed.
How it works
Planning wireless coverage
A site survey measures signal strength and interference in a building. The results are often shown as a heat map, which helps place access points so that coverage is complete without too much overlap.
Channel planning avoids interference between neighboring access points. In the 2.4 gigahertz (GHz) band, channels 1, 6 and 11 do not overlap, which is why they are the common choice.
Wireless security protocols
| Protocol | Notes |
|---|---|
| Wired Equivalent Privacy (WEP) | Broken, do not use |
| Wi-Fi Protected Access (WPA) | Old, based on the Temporal Key Integrity Protocol (TKIP), avoid |
| Wi-Fi Protected Access 2 (WPA2) | Uses the Advanced Encryption Standard (AES) with the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP), widely used, personal mode relies on a pre-shared key |
| Wi-Fi Protected Access 3 (WPA3) | Current standard, personal mode uses Simultaneous Authentication of Equals (SAE) instead of a plain pre-shared key exchange |
WPA3 personal makes offline guessing of the password harder, even if an attacker captures the handshake. Traditional open networks give no encryption of their own, so traffic should be protected another way, such as a virtual private network (VPN).
Personal and enterprise modes
| Mode | Authentication |
|---|---|
| Personal | One shared passphrase for everyone |
| Enterprise | Each user or device authenticates with 802.1X, usually against a Remote Authentication Dial In User Service (RADIUS) server |
Enterprise mode gives individual accountability and lets you revoke one user without changing a shared password. It uses the Extensible Authentication Protocol (EAP) with certificates or credentials. A captive portal is a web page that users must pass before they get access, often used for guest networks.
Mobile device management
Mobile device management (MDM) is a central system that enforces policy on phones and tablets.
| MDM capability | Purpose |
|---|---|
| Remote wipe | Erase a lost or stolen device |
| Screen lock, personal identification number (PIN) and biometrics | Protect against casual access |
| Full device encryption | Protect stored data |
| Application control | Allow or block apps |
| Containerization | Separate work data from personal data |
| Geofencing | Apply rules based on location |
| Push notifications and patching | Deliver updates and messages |
Deployment models
| Model | Meaning |
|---|---|
| Bring your own device (BYOD) | The employee owns the device and uses it for work |
| Corporate owned, personally enabled (COPE) | The company owns it and allows personal use |
| Choose your own device (CYOD) | The employee picks from an approved list, usually company owned |
BYOD is cheap and popular but makes control harder, so containerization is common. COPE and CYOD give the company more control.
Connection methods
Mobile devices connect through cellular, Wi-Fi and Bluetooth. Each has risks, such as rogue access points on Wi-Fi and nearby attacks on Bluetooth. Turn off Bluetooth when unused and avoid unknown networks.
What to remember for the exam
- A site survey and heat map guide access point placement.
- WEP and WPA are weak. WPA2 is common, and WPA3 is the current standard.
- WPA3 personal uses SAE to resist offline password guessing.
- Enterprise mode uses 802.1X with a RADIUS server and gives per user authentication.
- MDM supports remote wipe, encryption, app control and containerization.
- BYOD is user owned, COPE is company owned with personal use allowed, and CYOD is a user pick from an approved list.
- Geofencing applies rules by location.
- A captive portal is commonly used for guest Wi-Fi.
When a question asks how to remove access for one departing user on Wi-Fi without disturbing everyone else, enterprise mode with 802.1X is the answer.
Common mistakes
Choosing WEP or WPA for "compatibility". They are broken or weak and should be replaced.
Using one shared passphrase for a large company. When someone leaves, the passphrase must be changed for everyone.
Mixing up BYOD and COPE. In BYOD the employee owns the device. In COPE the company does.
Assuming MDM encrypts the network traffic. It enforces device policy, while a VPN or Transport Layer Security (TLS) protects the traffic.
Believing a hidden network name is security. Hiding the name does not encrypt anything and is easy to bypass.
Rooted or jailbroken devices can bypass MDM controls. Configure MDM to detect them and block access to company resources.
Check yourself
What does a heat map from a site survey show?
The strength of the wireless signal across an area, which guides access point placement.
Which wireless mode lets you remove one user without changing a shared password?
Enterprise mode, which uses 802.1X to authenticate each user individually.
What is the difference between BYOD and COPE?
In BYOD the employee owns the device, while in COPE the company owns it and permits personal use.
Topic 2 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.