Table Of ContentCopyright © 2016 by CertiTrek Publishing. All rights reserved. Printed in the United
States of America. Except as permitted under the United States Copyright Act of 1976,
no part of this publication may be reproduced or distributed in any form or by any
means, or stored in a database or retrieval system, without the prior written permission
of the publisher.
All trademarks or copyrights mentioned herein are the possession of their respective
owners and CertiTrek Publishing makes no claim of ownership by the mention of
products that contain these marks. Trademarks include CWNP®, CWTS®, CWNA®,
CWSP®, CWDP®, CWAP®, CWNE®, and CWNT®.
Second printing December 2016
ISBN: 978-0-9971607-2-7
Technical Editors Authors Blog Contributors
Tom Carpenter Lee Badman Dale Rapp
Daniel Koczwara Robert Bartz Lee Badman
Copy Editors Devin Akin
CWNP Staff Andrew von Nagy
Rasika Navanajith
Production Supervisor Project Manager Sam Clements
Josie Miller Brad Crump Jake Snyder
Chris Lyttle
Introduction
Security is important for the simple reason that information is valuable. If information
shared on networks had no value, you could leave all networks open and never give a
second thought to security. However, in the world we live in hardly a week goes by
without some significant network breach and theft of information headlined in the media.
Information is an important asset for both individual and business users.
As a security professional you must protect information at levels appropriate to the
value of the asset. A fundamental principle in information security is that the cost of
protection should not be greater than the value of the protected asset, and that the value
of the asset must be determined as a lifetime value and not an acquisition value.
However, in most cases, over time we tend to spend less to protect an asset than its
actual lifetime value. This is because we must consider risk in the equation.
The good news for wireless administrators is that 802.11 WLANs can be secured at
costs far below the value of the informational assets that we are typically protecting.
Implementing the most secure WLAN solutions is typically accomplished for less than
five to ten dollars per node, and the benefits of this security greatly exceed the costs. At
the same time, wireless networks when compared to traditional wired networks face
unique security challenges and require specialized knowledge and skill to properly
secure them. In this book we will examine what makes wireless security unique and how
wireless security fits in with overall network security.
This book is a study guide for the CWNP® certification of Certified Wireless Security
Professional (CWSP®), and covers the topics addressed in exam CWSP-205.
The purpose of the CWSP exam is to prove your knowledge and real-world, critical-
thinking skills related to security in 802.11 networks. As a professional-level exam on
the CWNP certification path, CWSP requires that you also pass the CWNA® exam. After
passing both exams, you will be a CWNA and CWSP-certified professional with
documented proof that you possess important skills for administering and securing
modern wireless networks.
CWSP-205 Exam Objectives
The CWSP-205 exam is organized into four knowledge domains as follows:
■ Wireless Network Attacks and Threat Assessment—20%
■ Security Policy—5%
■ Wireless LAN Security Design and Architecture—50%
■ Monitoring and Management—25%
This breakdown means that 20% of the questions on the exam are in the first knowledge
domain, 5% in the second and so on. This means that the largest pool of questions come
from the Wireless LAN Security Design and Architecture knowledge domain.
The following detailed objectives list should be used as your guide during exam
preparation. All exam questions are written to the objectives.
CWSP-205 Objectives
1.0 Wireless Network Attacks and Threat Assessment
—20%
1.1 Describe general network attacks common to wired and wireless networks,
including DoS, phishing, protocol weaknesses, and configuration error exploits.
1.2 Recognize common attacks and describe their impact on WLANs, including PHY
and MAC DoS, hijacking, unauthorized protocol analysis and eavesdropping,
social engineering, man-in-the-middle, authentication and encryption cracks, and
rogue hardware.
1.3 Execute the preventative measures required for common vulnerabilities on
wireless infrastructure devices, including weak/default passwords on wireless
infrastructure equipment and misconfiguration of wireless infrastructure devices by
administrative staff.
1.4 Describe and perform risk analysis and risk mitigation procedures, including asset
management, risk ratings, loss expectancy calculations, and risk management
planning.
1.5 Explain and demonstrate the security vulnerabilities associated with public access
or other unsecured wireless networks, including the use of a WLAN for spam
transmission, malware injection, information theft, peer-to-peer attacks, and
Internet attacks.
2.0 Security Policy—5%
2.1 Explain the purpose and goals of security policies, including password policies,
acceptable use policies, WLAN access policies, personal device policies, device
management (APs, infrastructure devices, and clients), and security awareness
training for users and administrators.
2.2 Summarize the security policy criteria related to wireless public access network
use, including user risks related to unsecured access and provider liability.
2.3 Describe how devices and technology used from outside an organization can
impact the security of the corporate network, including topics like BYOD, social
networking, and general MDM practices.
3.0 Wireless LAN Security Design and Architecture—
50%
3.1 Describe how wireless network security solutions may vary for different wireless
network implementations, including small businesses, home offices, large
enterprises, public networks, and remote access.
3.2 Understand and explain 802.11 Authentication and Key Management (AKM)
components and processes, including encryption keys, handshakes, and pre-shared
key management.
3.3 Define and differentiate among the 802.11-defined secure networks, including pre-
RSNA security, Transition Security Networks (TSN), and Robust Security
Networks (RSN) and explain the relationship of these networks to terms including
RSNA, WPA, and WPA2.
3.4 Identify the purpose and characteristics of IEEE 802.1X and EAP and the
processes used, including EAP types (PEAP, EAP-TLS, EAP-TTLS, EAP-FAST
and EAP-SIM), AAA servers (RADIUS), and certificate management.
3.5 Recognize and understand the common uses of VPNs in wireless networks,
including remote access points, VPN client access, WLAN controllers, and cloud
architectures.
3.6 Describe, demonstrate, and configure centrally managed client-side security
applications, including VPN client software and policies, personal firewall
software, mobile device management (MDM), and wireless client utility software.
3.7 Describe and demonstrate the use of secure infrastructure management protocols,
including HTTPS, SNMP, secure FTP protocols, SCP, and SSH.
3.8 Explain the role, importance, and limiting factors of VLANs and network
segmentation in an 802.11 WLAN infrastructure.
3.9 Understand additional security features in WLAN infrastructure and access
devices, including management frame protection, Role-Based Access Control
(RBAC), Fast BSS transition (pre-authentication and OKC), physical security
methods, and Network Access Control (NAC).
3.10 Explain the purpose, methodology, features, and configuration of guest access
networks and BYOD support, including segmentation, guest management, captive
portal authentication, and device management
4.0 Monitoring, Management, and Tracking—25%
4.1 Explain the importance of ongoing WLAN monitoring and the necessary tools and
processes used, as well as the importance of WLAN security audits, and
compliance reports.
4.2 Understand how to use protocol and spectrum analyzers to effectively evaluate
secure wireless networks, including 802.1X authentication troubleshooting,
location of rogue security devices, and identification of noncompliant devices.
4.3 Understand the command features and components of Wireless Intrusion Prevention
Systems (WIPS) and how they are used in relation to performance, protocol,
spectrum, and security analysis.
4.4 Describe the different types of WLAN management systems and their features,
including network discovery, configuration management, firmware management,
audit management, policy enforcement, rogue detection, network monitoring, user
monitoring, event alarms, and event notifications.
4.5 Describe and implement compliance monitoring, enforcement, and reporting.
Topics include industry requirements, such as PCI-DSS and HIPAA, and general
government regulations.
Target Audience
As an important note, this book is written for those preparing for the CWSP certification
exam, and not as a general guide to all topics related to wireless networking.
Collectively, the study of designing, securing, and supporting WLAN environments is far
too wide-ranging to effectively cover in one book or with a single certification exam.
This book is intended for the individual who already understands wireless networking
from a functional perspective equivalent to the Certified Wireless Network
Administrator (CWNA) certification. There is no in-depth review of basic 802.11
fundamentals in this text. If you are CWNA certified, then you are ready to begin
exploring this book with the prerequisite background required for progressing towards
CWSP. However, if you are not CWNA certified, you should have an equivalent
knowledge of wireless networks before venturing further.
Throughout this book, the term “802.11” is used to
reference Institute of Electrical and Electronics
Note:
Engineers (IEEE) 802.11. The acronym IEEE is not
used each time to allow for faster reading.
Acknowledgements for Content
Finally, we at CWNP would like to thank the following individuals for assisting us in
the production of this resource. They provided valuable content that greatly improved
the book to help CWSP students and security professionals everywhere.
Major Content Contributors
Lee Badman contributed significant content and provided editing expertise for the most
recent version of this book. As a long-time wireless network professional, classroom
instructor, and technical writer, his work can be seen in the networks he has designed
and currently supports at dozens of sites internationally, and in the hundreds of articles
he has published for several online periodicals. A number of current industry
professionals have participated as students in his network classes at the private
university where Lee is an adjunct faculty member. Learn more about his professional
activities at wirednot.net.
Robert Bartz, of Eight-O-Two Technology Solutions, assisted in the creation and
editing of a significant portion of this material. His years of experience in teaching
CWSP classes and real-world experience brought a wealth of knowledge and insight to
the project. To learn more about Robert and his training and consulting services, which
are continually rated among the highest in the industry, visit his website at
eightotwo.com.
Tom Carpenter provided the technical editing efforts for the book and significant
content as well. Tom is the author of several books on wireless networking, server
administration, converged networking, and other IT topics. He is the CTO at CWNP, and
provides direction and guidance in the development of new certifications and updates to
existing certifications. Learn more about Tom’s thoughts at tomcarpenter.net.
Daniel Koczwara is a Senior Field Application Engineer at EnGenius Technologies
where he has done technical writing and technical training, product testing and
development, as well as pre-sales network design and post-sales troubleshooting for
hundreds of 900MHz cordless telephony and 2.4 GHz / 5 GHz Wi-Fi networks. He has
over 20 years’ experience in communications and is active in Amateur Radio. He also
has a General Radio Operators License (GROL), and numerous CompTIA certifications
and is currently applying for CWNE®.
Bloggers
The following authors provided one or more blog submissions, and their blogs are well
worth visiting on a regular basis:
■ Dale Rapp—dalewifisec.wordpress.com—Chapters 1 and 2
■ Lee Badman—wirednot.wordpress.com—Chapter 3
■ Andrew von Nagy—www.revolutionwifi.net—Chapter 4
■ Rasika Nayanajith—mrncciew.com—Chapter 5
■ Sam Clements—sc-wifi.com—Chapter 6
■ Jake Snyder—transmitfailure.blogspot.com—Chapter 7
■ Chris Lyttle—www.wifikiwi.com—Chapter 8
■ Devin Akin——Chapter 9
Table of Contents
INTRODUCTION
CWSP-205 EXAM OBJECTIVES
TARGET AUDIENCE
ACKNOWLEDGEMENTS FOR CONTENT
CHAPTER 1: SECURITY FUNDAMENTALS
OBJECTIVES
A BRIEF HISTORY OF WIRELESS SECURITY
RADIO FREQUENCY (RF) DOES NOT RESPECT BOUNDARIES
USAGE THREAT ASSESSMENT
NETWORK EXTENSION
CWNA SECURITY REVIEW
INDUSTRY ORGANIZATIONS
WI-FI ALLIANCE COMPLIANCE
PRODUCT CERTIFICATES
TERMINOLOGY REVIEW
HOME OFFICE SECURITY
SMALL BUSINESS SECURITY
LARGE ENTERPRISE SECURITY
PUBLIC NETWORK SECURITY
REMOTE ACCESS SECURITY
SECURITY AND THE OSI MODEL
SECURITY ANALYSIS BASICS
FROM THE BLOGS
CHAPTER REVIEW
CHAPTER 1: REVIEW QUESTIONS
CHAPTER 1: REVIEW ANSWERS
CHAPTER 2: WIRELESS SECURITY CHALLENGES
OBJECTIVES
PASSIVE WLAN DISCOVERY
ACTIVE WLAN DISCOVERY
DISCOVERY HARDWARE
