Wi-Fi Security — Practitioner

Publication details and purpose

• Publication: Wi-Fi Security — Practitioner
• Authority: Issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre); unclassified.
• Effective date: March 31, 2022.
• Revision history: Revision 1, first release, March 31, 2022.
• Audience: Organizations of all sizes, public and private, that use Wi-Fi.
• Wi-Fi is used in homes, workplaces, and public places; increasing reliance on it makes wireless-network security essential to reducing cyber-threat risks.
• Wi-Fi performs critical tasks and may transmit sensitive or confidential information, including trade secrets, personal information (PI), and copyrighted material.
• A network is only as secure as its weakest link; Wi-Fi is an easy target for threat actors.
• Publication scope: vulnerabilities, recommended policies, technical controls, security measures, and additional network-wide security considerations.

1. Wi-Fi threat awareness

• First steps in securing a network:
  • Build awareness.
  • Identify risks.
  • Remediate known vulnerabilities in poorly secured Wi-Fi.

1.1 Network attacks and risk reduction

1.2 Breach examples

2. Best practices

2.1 Data structures

• Structuring resources makes provisioning, maintenance, and security easier, while ensuring sensitive data is accessible only to those who need it.
• Without structure, data may be placed anywhere, with no distinction between sensitive and public information.

2.1.1 Limiting information available

• Do not transmit sensitive information—e.g., business-proprietary, classified, confidential, or personal data—on open networks without additional encryption controls: nearby threat actors can intercept communications.
• Apply least privilege: each associate accesses only the files and resources required for their job.
• Further information: ITSG-33, IT Security Risk Management: A Lifecycle Approach.

2.1.2 Structuring classes of data

• Data classes help prevent sensitive data from leaving its protected area and limit damage from data or privacy breaches.
• Structure data to meet security and privacy needs and protect personal and confidential information.

2.1.3 Structuring Wi-Fi and wired networks

• Wi-Fi devices can have multiple service set identifiers (SSIDs).
• Give each SSID its own VLAN to restrict access to internal network zones, alongside other security measures. Beware of defaults allowing all traffic between SSIDs or VLANs; see section 2.3.2.
• Guest Wi-Fi:
  • Limit how long a guest password can be used (e.g., expire daily or issue guest passes), so only current guests can access the network.
• Further zoning information: ITSG-38, Network Security Zoning – Design Considerations for Placement of Services within Zones.

2.2 Policy-based controls

• Written policy should fully reflect the organization’s security and privacy position; technical controls implement policy.
• Technical controls without written policy may not withstand legal challenges.

2.3 Technical controls

• Technical controls should prevent security incidents and ensure data integrity through safe, secure access.
• Without them, device data can be accidentally or maliciously intercepted, falsified, or compromised.

2.3.1 Wi-Fi encryption and PSK versus EAP

Encryption methods

• Choose an encryption method compatible with all devices and network equipment.

PSK versus EAP

2.3.2 VLANs and SSIDs

• An SSID is the commonly named Wi-Fi/network name that lets users identify a network to connect to.
• Never put PI or confidential data in an SSID.
• Personal users and small businesses commonly use one or two SSIDs (e.g., employee and guest networks).
• VLANs create virtual networks on the same physical infrastructure; most managed switches and firewalls support them.
• Combine VLANs with SSIDs to create separate security zones.
  • Use a VLAN separate from all wired traffic for wireless traffic; configure the SSID accordingly.
  • Put guest access on a restricted VLAN.
  • Enable client isolation on all APs and SSIDs where available, preventing clients from communicating directly with one another.
• Printers and IoT devices may not support WPA-EAP because of cost constraints:
  • Place them on a separate, secure network isolated from employee and guest networks.
  • Do not let users access these networks; lock them down with a very strong password.

2.3.3 RADIUS

• RADIUS works with EAP to provide secure authentication using a RADIUS server reached from an AP or AP controller.
• Ensure the server uses a secure secret for devices to connect and authenticate; the secret is equivalent to a passphrase.
• Keep AP, AP-controller, and RADIUS-server software up to date; manage accounts closely.
• Many RADIUS servers connect to a directory for SSO authentication, typically Active Directory (AD) or an online cloud-directory service.

2.3.4 Directory security

• The directory validates credentials, in addition to the roles of APs, controllers, and RADIUS servers.
• Use role-based access control (RBAC) and physical and cyber security policies to protect the directory service.
• AD is commonly used as the directory for SSO authentication.
• Secure the entire directory server: OS, applications, services, accounts, permissions, firmware, and hardware.

2.3.5 Virtual private networks (VPNs)

2.3.6 WPS

• WPS makes network connection easier and is typically found on SOHO equipment.
• May allow connection by pressing a physical button on the AP instead of entering a password.
• Available only on WPA-encrypted networks.
• Modern versions also allow a 6-digit pin, which inherently bypasses network password requirements.
• Disable WPS completely on any wireless equipment used for business because it is not secure.

2.3.7 Endpoint security

• Every entry point into a wireless network is a potential attack vector; securing every endpoint helps mitigate risk.
• Mobile device management (MDM) software can identify mobile-device users and configure/push Wi-Fi, VPN, and authentication-token settings to devices.
• General endpoint-security recommendations: ITSP.70.012, Guidance for Hardening Microsoft Windows 10 Enterprise.
• General mobile-security information: ITSAP.00.001, Using Your Mobile Device Securely.
• Secure organizational BYOD devices through both policy and technical controls.

2.3.8 Physical security

• Physical security is as important as cyber security. It reduces the chance of:
  • Someone resetting devices and connecting with default credentials.
  • Connecting to the wired network through wireless equipment.
  • Connecting to wireless equipment and stealing credentials.
• A factory-reset device may expose an entire subnetwork to anyone connecting to its default network—for example, where wireless devices or controllers are configured for trunking.
• An attacker may place a network-tapping device between a network and a wireless or wired device.
  • Such products are readily available online and allow access to network traffic as a person-in-the-middle attack (PITMA).
  • They can inject malicious code or websites into in-transit traffic, or provide remote access through a reverse VPN tunnel.
• Protect wireless infrastructure against physical access to both:
  • Wireless components (e.g., Wi-Fi-connected IoT lightbulbs).
  • Components bridging back into the wired network.

2.3.9 Wireless intrusion detection systems

• Wireless intrusion detection systems (WIDS) and wireless intrusion prevention systems (WIPS) detect and possibly mitigate active attacks carried out through radio frequency (RF).
• RF monitoring, combined with wired-network tools and protections, helps secure wireless infrastructure.
• One use: find and deactivate rogue APs connected to the wired network.
  • These APs were not authorized and provisioned by the organization.
  • They may use poor or no encryption and authentication, reducing visibility into connected devices and their locations.
  • WIDS/WIPS can reduce how long rogue APs remain online; without them, rogue APs could go unnoticed indefinitely.
• Some systems are integrated into APs and use AP radios both to serve clients and monitor RF as sensors.
  • Dual use may reduce user time or bandwidth because a radio can be in only one mode at a time: monitor mode, or sending and receiving as an AP.

2.4 Training-based controls

• Training should be mandatory for new and existing employees so new threats and policy changes are communicated.
• Everyone using Wi-Fi should understand:
  • How to identify spoofed networks.
  • How the organization’s Wi-Fi networks differ and why.
  • Which uses are allowed on each SSID and VLAN segment.
  • How to connect correctly.
  • How and to whom to report wireless security incidents.
  • How to obtain support.

2.4.1 General IT training

• Builds a foundation for wireless-device security, improves cyber-security practice at work, and raises awareness of personal cyber security.
• Topics: available systems, data classes, data lifecycle, user permissions, and policies for Wi-Fi and network resources.
• Users should have playbooks and procedures for secure interaction with systems and data.
• Review procedures regularly and update them when structure or software changes.

2.4.2 Device use

• Train users on wireless standards and device use.
• Showing users how to secure their own devices can improve workplace culture and security.
• Hands-on sessions demonstrating settings changes add variety and engage visual learners.

2.4.3 Wi-Fi security courses

• Online courses can improve general Wi-Fi security knowledge; select courses designed for average users.
• Cover best practices for unencrypted and public Wi-Fi, VPNs, and mobile devices, plus signs a device has been compromised and steps to address the issue.

3. Additional considerations

3.1 Legal implications

• Consider legal implications of policies and requirements before implementation; the publication is not legal advice.
• Seek a lawyer to ensure compliance with Canadian laws.
• Personal equipment, including BYOD or home equipment, may have legal implications.
• For penetration testers, set boundaries, limit scope to specific areas, and verify trustworthiness through industry reputation and references.

3.2 Increased technical support

• Implementing these technical controls requires additional technical support.
• Controls may prevent users working as they are accustomed to; devices may require extra steps or configuration.
• Protecting data is necessary, but the organization also needs resources to support users.

3.3 Availability

• Without available authentication or network infrastructure, users cannot access needed resources.
• Consider high availability and disaster recovery for critical infrastructure.
• Multiple APs can provide staggered coverage in nearby areas during an outage.
• Wireless signals are subject to jamming, so availability cannot be guaranteed.
• A robust wired network, ability to plug in critical devices, and segregation of wired and wireless networks are important.
• This can allow wireless attacks to be isolated from, and the wireless network disconnected from, the wired network if needed.

4. Summary

• Organizations need appropriate Wi-Fi policies, technical controls that enforce those policies, and staff training.
• The wireless landscape grows daily as more smart-enabled devices include Wi-Fi, and the threat landscape has never been larger.
• Securing the network and understanding threats helps protect a business environment for the future.

5. Supporting content

5.1 Abbreviations

5.2 Glossary

• Authentication: A process or measure used to identify a user’s identity.
• BYOD: Employees use their own devices for business purposes; organizations may cover some of the cost. Because the organization does not own the device, it has little control over the security controls implemented on it.
• Classified information: A Government of Canada label for specific sensitive data whose compromise could harm the national interest, such as national defence, relationships with other countries, or economic interests.
• Confidentiality: The ability to protect sensitive information from access by unauthorized people.
• DDoS attack: An attack in which multiple compromised systems attack one target. The flood of incoming messages forces the target to shut down and denies service to legitimate users.
• Encryption: Converting information from one form to another to hide its content and prevent unauthorized access.
• Integrity: The ability to protect information from unintended modification or deletion, and to help determine whether information is what it claims to be. Integrity also applies to business processes, software application logic, hardware, and personnel.
• IoT: A network of everyday web-enabled devices capable of connecting and exchanging information with one another.
• Least privilege: Giving an individual only the privileges essential to authorized tasks. This limits damage from accidental, incorrect, or unauthorized use of an information system.
• Personal information (PI): Information about an identifiable individual recorded in any form.
• Threat: Any potential event or act, deliberate or accidental, or natural hazard that could compromise IT assets and information.
• Vulnerability: A flaw or weakness in the design or implementation of an information system or its environment that a threat actor could exploit to adversely affect an organization’s assets or operations.
• Wi-Fi: Wireless technology that connects devices such as laptops and smartphones to the Internet, using radio waves and a wireless router instead of a physical wired connection.

5.3 References

1. Canadian Centre for Cyber Security, ITSP.40.062, Guidance on Securely Configuring Network Protocols, October 2020.
2. Canadian Centre for Cyber Security, ITSP.40.111, Cryptographic Algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B Information, August 2016.
3. Cnet, “WeWork’s weak Wi-Fi security leaves sensitive documents exposed,” September 2019.
4. IoT World Today, “IoT Cyberattacks Escalate in 2021, According to Kaspersky,” September 2021.
5. Threat Post, “Thousands of university Wi-Fi networks expose log-in credentials,” September 2021.
6. Canadian Centre for Cyber Security, ITSG-33, IT Security Risk Management: A Lifecycle Approach, November 2018.
7. Canadian Centre for Cyber Security, ITSG-38, Network Security Zoning – Design Considerations for Placement of Services within Zones, May 2009.
8. Canadian Centre for Cyber Security, ITSAP.30.032, Best Practices for Passphrases and Passwords, September 2019.
9. Canadian Centre for Cyber Security, ITSP.70.012, Guidance for Hardening Microsoft Windows 10 Enterprise, March 2019.
10. Canadian Centre for Cyber Security, ITSAP.00.001, Using Your Mobile Device Securely, December 2020.

Active recall

1. What risks arise from unpatched firmware, insecure defaults, shared networks, IoT devices, rogue APs, weak authentication, and weak encryption—and what mitigations are recommended?
2. How do the three data classes differ, and how should Wi-Fi, wired networks, SSIDs, VLANs, and guest access be structured?
3. Compare WEP, WPA 1, WPA2, and WPA3; why is PSK not recommended for business use, and what authentication practices are recommended?
4. What are the distinct roles of RADIUS, directory services, corporate VPNs, endpoint controls, physical security, and WIDS/WIPS in securing Wi-Fi?
5. What policies, training, legal considerations, support needs, and availability measures should organizations address when securing Wi-Fi?