By Eric Geier (NoWiresSecurity Founder & Owner) - originally published on InformIT.com

 

As you may know already, Wired Equivalent Privacy (WEP) security is not secure. This first wireless LAN security standard, developed by the IEEE, has been vulnerable to cracking by Wi-Fi hackers for nearly a decade now.

In 2003, the Wi-Fi Alliance released a security standard called Wi-Fi Protected Access. Although the first version (WPA), which uses TKIP/RC4 encryption, has gotten beaten up a bit, is not totally cracked, and can still be very secure.

The second version (WPA2), released in mid-2004, does provide complete security, however, because it fully implements the IEEE 802.11i security standard with CCMP/AES encryption.

In this article, we'll discover the two very different modes of Wi-Fi Protected Access. We'll see how and why you'd want to move from the easy-to-use Personal mode to the Enterprise mode.

Now let's get started!

Two Modes of WPA/WPA2: Personal (PSK) versus Enterprise

Both versions of Wi-Fi Protected Access (WPA/WPA2) can be implemented in either of two modes:

 

• Personal or Pre-Shared Key (PSK) Mode: This mode is appropriate for most home networks—but not business networks. You define an encryption passphrase on the wireless router and any other access points (APs). Then the passphrase must be entered by users when connecting to the Wi-Fi network.
  
  Though this mode seems very easy to implement, it actually makes properly securing a business network nearly impossible. Unlike with the Enterprise mode, wireless access can't be individually or centrally managed. One passphrase applies to all users. If the global passphrase should need to be changed, it must be manually changed on all the APs and computers. This would be a big headache when you need to change it; for instance, when an employee leaves the company or when any computers are stolen or compromised.
  
  Unlike with the Enterprise mode, the encryption passphrase is stored on the computers. Therefore, anyone on the computer—whether it be employees or thieves—can connect to the network and also recover the encryption passphrase.

• Enterprise (EAP/RADIUS) Mode: This mode provides the security needed for wireless networks in business environments. Though more complicated to set up, it offers individualized and centralized control over access to your Wi-Fi network. Users are assigned login credentials they must present when connecting to the network, which can be modified or revoked by administrators at anytime.
  Users never deal with the actual encryption keys. They are securely created and assigned per user session in the background after a user presents their login credentials. This prevents people from recovering the network key from computers and is used as a standard in networks.

 

Introducing 802.1X Authentication and RADIUS Servers

The authentication method used to verify the user (and server) credentials on WPA/WPA2-Enterprise networks is defined in the IEEE 802.1X standard. This requires an external server called a Remote Authentication Dial In User Service (RADIUS) or Authentication, Authorization, and Accounting (AAA) server, which is used for a variety of network protocols and environments including ISPs.

A RADIUS server understands the Extensible Authentication Protocol (EAP) language and communicates with the wireless APs, referred to as RADIUS clients or authenticators. The RADIUS server basically serves as a middle-man between the APs and the user database. The APs then communicate directly with the 802.1X client, also referred to as an 802.1X Supplicant, on the end-user's computer or device.

802.1X authentication is port-based. This means that when someone attempts to connect to the enterprise-protected network, communication is allowed through a virtual port for the purpose of transferring login credentials. If authentication is successful, encryption keys are securely passed out and full access is given to the end-user.

Getting an Authentication Server

There are a few routes you can go to get an 802.1X authentication server:

• FreeRADIUS: This is one of the most popular AAA servers in the world. Though it's a free open source project, it's more for advanced IT personnel. It is available for many different platforms, including Linux, Mac OS X, and Windows. By default, you change the settings in configuration files.

• Windows Server: If you already have a Windows Server set up, you can use the included Internet Authentication Service (IAS) in Windows Server 2003 or the Network Policy Server (NPS) in Windows Server 2008.

• Outsourced Services: Hosted services, such as AuthenticateMyWiFi, are great for those who don't want to invest a lot of money or time setting up a RADIUS server, have multiple offices, or don't have the technical expertise.hese services can also provide additional functionality over traditional RADIUS servers.
   

The Different Flavors of EAP

The brain behind 802.1X authentication is actually the Extensible Authentication Protocol (EAP). There are many types or favors of EAP. The type an organization should use depends upon the desired level of security, desired complexity, and the server/client specs.

Here are the most popular types:

• PEAP (Protected EAP): This method is one of the most popular and easy-to-implement EAP types. It authenticates end-users via usernames and passwords they must enter when connecting to the network.
  
  The authentication server can also be validated during PEAP authentication when an SSL certificate is installed on the server. This type is supported by default in Windows.

• TLS (Transport Layer Security): This type is one of the most secure flavors, but takes more to implement and maintain. Both client and server validation is done via SSL certificates. Instead of providing a username and password when connecting, end-user devices or computers must have a SSL certificate file loaded into its 802.1X client.
  
  The administrators control the certificate authority (CA) and hand out the client certificates, giving administrators more control, but requiring more administrative time.

• TTLS (Tunneled TLS): An improved version of TLS that doesn't require client-side security certificates, reducing overhead to manage the network. However, this EAP type doesn't have native support in Microsoft Windows; it requires a third-party client like SecureW2.

 

Your Next Steps

You’ve discovered how 802.1X authentication makes WPA/WPA2-Enterprise encryption the way to secure Wi-Fi networks in businesses. You also learned that an authentication server is required and that PEAP, TLS, and TTLS are the popular EAP types.

Here are a few tips to help you with your next steps:

 

• Find and select a RADIUS server or outsourced service.

• Set up the RADIUS server with the EAP, AP, and user settings.

• Configure your APs with the encryption and RADIUS server information.

• Configure Windows (or other OS) with the encryption and 802.1X settings.

• Finally, connect to your Enterprise-protected network!