Enterprise Virtual, Cloud, and Wireless Network Protection · Topic 5 of 5
Wireless Networks, Encryption, Authentication and Security
Learn wireless fundamentals, WEP, WPA, WPA2 and WPA3 encryption, 802.1X and EAP authentication, and the security measures that protect a Wi-Fi network.
- 5 min
- Includes a diagram
- Strength order: WEP, then WPA with TKIP, then WPA2 with AES-CCMP, then WPA3.
- WPA3 uses SAE and requires protected management frames.
- 802.1X has supplicant, authenticator and authentication server (RADIUS).
What it is
A wireless LAN (WLAN) sends data through the air using the IEEE 802.11 standards. Anyone in range can receive the signal, so protection depends on strong encryption, strong authentication and good design.
A defender must know the building blocks, the order of encryption strength, how users prove who they are, and which measures reduce risk.
How it works
Wireless fundamentals
| Term | Meaning |
|---|---|
| SSID | The network name |
| BSSID | The MAC address of the access point radio |
| Access point (AP) | Connects wireless clients to the wired network |
| Infrastructure mode | Clients connect through an AP |
| Ad hoc mode | Clients connect directly to each other |
| WLAN controller | Central management of many APs |
| Channel | A slice of a radio band used by an AP |
| Standard | Common name | Band |
|---|---|---|
| 802.11b | No official name | 2.4 GHz |
| 802.11a | No official name | 5 GHz |
| 802.11g | No official name | 2.4 GHz |
| 802.11n | Wi-Fi 4 | 2.4 and 5 GHz |
| 802.11ac | Wi-Fi 5 | 5 GHz |
| 802.11ax | Wi-Fi 6 (and 6E) | 2.4, 5 and 6 GHz (6 GHz with 6E) |
Wireless encryption mechanisms
| Protocol | Cipher | Status |
|---|---|---|
| WEP | RC4 with a 24 bit initialization vector | Broken. Can be cracked in minutes. Do not use |
| WPA | RC4 with TKIP (per packet key mixing) | Deprecated. A stopgap for old hardware |
| WPA2 | AES with CCMP | Strong. Standard for years. 802.11i |
| WPA3 | AES, with SAE for personal networks | Current. Best choice |
WPA3 improvements:
- SAE (Simultaneous Authentication of Equals) replaces the WPA2 pre-shared key handshake, resists offline dictionary attacks and gives forward secrecy.
- Protected Management Frames are required, which blocks forged deauthentication frames.
- Enhanced Open (OWE) encrypts traffic on open networks without a password.
- WPA3 Enterprise offers a 192 bit security mode.
Wireless authentication methods
| Method | How it works | Strength |
|---|---|---|
| Open | No authentication | None |
| Shared passphrase (PSK) | Everyone uses the same passphrase (WPA2 Personal, WPA3 Personal) | Fine for homes, weak when widely shared |
| 802.1X with EAP | Each user authenticates to a RADIUS server (WPA2 or WPA3 Enterprise) | Strongest |
| MAC filtering | Allow list of device addresses | Weak, because MAC addresses can be copied |
| Captive portal | A web page login for guests | Controls access, does not encrypt |
In 802.1X there are three roles: the supplicant (the client), the authenticator (the AP or switch) and the authentication server (RADIUS). RADIUS uses UDP 1812 for authentication and 1813 for accounting. The AP passes EAP messages between client and server.
| EAP type | Notes |
|---|---|
| EAP-TLS | Client and server certificates. Strongest |
| PEAP | Server certificate builds a tunnel, then the user logs in with a password |
| EAP-TTLS | Tunnel with a server certificate, flexible inner method |
| EAP-FAST | Cisco method that uses a protected access credential |
Wireless network security measures
- Use WPA3, or WPA2 with AES (CCMP). Do not use WEP or TKIP.
- Use 802.1X with EAP-TLS or PEAP in business networks, and a long random passphrase for personal networks.
- Change default administrator passwords, update AP firmware and disable remote management over wireless.
- Disable WPS, because its PIN method can be guessed.
- Separate guest and corporate traffic with different SSIDs mapped to different VLANs.
- Deploy a wireless intrusion detection or prevention system (WIDS/WIPS) to find rogue APs and evil twins.
- Run site surveys and tune signal power so coverage does not extend far outside the building.
- Hiding the SSID is not security. It only hides the name from casual users.
- Enable protected management frames (802.11w) where supported.
A worked example
A cafe runs one network with a shared WPA2 passphrase printed on the wall. The owner also processes card payments on the same network.
The defender splits the network: guests get a separate SSID and VLAN with internet access only, and the point of sale systems sit on a protected network using WPA3 or WPA2 Enterprise with unique credentials. WPS is turned off and the router password changed.
How the exam asks about this
- "Which wireless protocol uses RC4 and a 24 bit IV and is easily cracked?" → WEP.
- "Which WPA3 feature replaces the pre-shared key handshake?" → SAE.
- "In 802.1X, which device relays authentication between the client and the RADIUS server?" → The authenticator (the AP or switch).
What to remember for the exam
- Strength order: WEP, then WPA with TKIP, then WPA2 with AES-CCMP, then WPA3.
- WPA3 uses SAE and requires protected management frames.
- 802.1X has supplicant, authenticator and authentication server (RADIUS).
- RADIUS uses UDP 1812 and 1813.
- EAP-TLS needs certificates on both sides and is the strongest EAP type.
MAC filtering and hidden SSIDs are not real protection. Attackers can see and copy both.
Common mistakes
Calling WPA2 Personal enterprise grade. A shared passphrase cannot identify individual users. Only 802.1X can.
Thinking WPA2 with TKIP is as strong as AES. TKIP is the weaker RC4 based option.
Forgetting rogue access points. An unauthorized AP on the wired network bypasses every other control, so monitor for it.
Check yourself
Why is WEP insecure?
It uses RC4 with a short 24 bit initialization vector that repeats, so the key can be recovered quickly.
Which RADIUS ports are used for authentication and accounting?
UDP 1812 and UDP 1813.
Name two measures that reduce wireless risk.
Disable WPS, and use WPA3 or WPA2 with AES. Deploying WIPS and segmenting guests also help.
Topic 5 of 5 in Enterprise Virtual, Cloud, and Wireless Network Protection
Test yourself on Enterprise Virtual, Cloud, and Wireless Network Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.