Index
- A
- AAA Server, 103, 118
- acceptable use policies (AUPs), captive portals for, 165–166
- access control, for captive portal processes, 167
- access control lists (ACLs), 22–23
- access hardware, 496
- Access Rights Planner, 262–267
- accounting, 122
- ad-hoc networks
- administrative access and authentication, controlling, 296–301
- administrative users, authentication of, 26
- AES-256-GCM, 83
- AirMagnet Planner, 413
- alerting
- analyst roles, 7–8
- Apple AirDrop, 391
- Apple MacOS, Fast Transition support and, 199
- Apple Wireless Direct Link (AWDL), 344
- appliance-based PEPs, 461
- application owners, 232
- Application Programming Interface (API), 176
- application protocols (APs)
- addressing default behavior, 325
- allowlisting, 322–323
- approving, 322–323
- authenticating, 326–327
- authorized, 392
- changing default credentials on, 295
- controlling ports in publicly accessible areas, 326
- enabling secure tunnels from, 324–325
- external, 393
- honeypot, 393
- impersonation, 385
- management VLAN, 186
- misconfigured, 384
- neighbor, 393
- placement of, as a planning and design output, 244
- port uplink redundancy, 204–205
- provisioning
- applications, as a planning and design input, 240
- Architect stage, in Design for Six Sigma (DFSS), 224–225
- architectures
- Aruba Networks, 80, 115, 299, 325, 383, 407, 440
- assessments. See testing and assessments
- association states, 95
- asymmetric-key algorithms, 28
- authentication and authorization
- about, 23–24, 101
- access control for captive portal processes, 167
- of administrative users, 26
- best practices
- captive portals
- certificates for authentication, 148–163
- change of authorization, 123–127
- of devices, 25–26
- disconnecting messages, 123–127
- EAP support, 132
- EAP-FAST, 130
- EAP-GTC, 135–136
- EAP-MSCHAPv2, 135
- EAP-PEAP, 129–130
- EAP-POTP, 136–137
- EAP-TEAP, 131
- EAP-TLS, 134–135
- EAP-TTLS, 130
- endpoint device certificates for 802.1X, 151–152
- 4-Way Handshake in Wi-Fi, 168–171
- IEEE 802.1X standard, 102–107
- in InfoSec, 24
- inner authentication methods, 133–137
- LDAP authentication for Wi-Fi, 168
- legacy EAP methods, 137–138
- logging/accounting, 122
- MAC authentication bypass with RADIUS, 140–147
- MAC authentication without RADIUS, 147
- MAC filtering and denylisting, 147–148
- Mac-based authentication, 140–148
- network access control (NAC) products, 108–110
- outer EAP tunnels, 129–132
- as a planning and design output, 244
- RADIUS
- recommended EAP methods for secure Wi-Fi, 138–140
- relationship of RADIUS, EAP, and infrastructure devices, 110–111
- securing tunneled EAP, 132–133
- security on open vs. enhanced open networks, 167
- server certificate, 121
- of servers, 26
- unsecured EAP methods, 137–138
- user directories, 121
- of users, 24–25
- of wireless infrastructure components, 26–27
- B
- backups, managing, 309–313
- bandwidth, as an IoT consideration, 467
- baselines, configuration, 312
- basic service set identifiers (BSSIDs), 188–189
- battery life, as an IoT consideration, 466
- best practices
- Bluetooth, 470–475
- Bluetooth Impersonation Attack (BIA), 474
- Bluetooth Low Energy (BLE), 470–475
- Bonjour, 347–350
- Border Gateway Protocol (BGP), 217
- BrakTooth, 473–474
- bridged communications, controlling, 339–353
- bring your own device (BYOD)
- about, 278–279
- as an emergent trend, 445–455
- captive portals for, 166–167
- defining in your organization, 259–261, 448–449
- with internal access, 547–549
- with Internet-only access, 553–555
- legal considerations for, 449–451
- policies for, 446
- recommendations for securing, 452–455
- technical considerations for securing, 451–452
- broadcast integrity protocol (BIPP), 318–319
- C
- California Consumer Protection Act (CCPA), 17
- Called-Station-ID, 112
- Calling-Station-ID, 112
- campus environments, 38
- captive portals
- cellular LANs, 481–499, 541
- cellular technology, 480, 559–561
- Center for Internet Security (CIS), 18
- central monitoring and alerting, 379–383
- certificate signing request (CSR), 151
- certificates
- Certified Wireless IoT Connectivity Professional (CWICP), 434
- Certified Wireless IoT Design Professional (CWIDP), 434
- Certified Wireless IoT Integration Professional (CWIIP), 434
- Certified Wireless IoT Solutions Administrator (CWISA), 434
- Certified Wireless Network Professionals (CWNP), 433, 436
- CFRS, 404
- change management, 309–313
- change of authorization (CoA), 123–127
- Characterize phase, in Design for Six Sigma (DFSS), 224
- Chief Executive Officer (CEO), 6–7
- Chief Information Officer (CIO), 6–7
- Chief Information Security Officer (CISO), 6–7, 231
- Chief Security Officer (CSO), 6–7
- Chief Technology Officer (CTO), 6–7
- choose your own device (CYOD) model, 446–447
- cipher suites, 79–80
- Cisco, 115, 299, 325, 383
- Cisco Discovery Protocol (CDP), 213–215
- classification, endpoints and, 239
- ClearPass Policy Manager (CPPM), 299
- client spoofing, 386
- clients
- cloaking SSIDs, 356–359
- closed box test, 375
- cloud native products, 459
- CloudExtreme, 299
- cloud-managed edge architectures, 440–441
- cloud-routed products, 459
- Commercial National Security Algorithm (CNSA), 82
- common vulnerabilities and exploits (CVEs), 370–372
- community, as resources, 436
- company-owned, business use only (COBO), 447
- company-owned, personally enabled (COPE) devices, 447
- compliance
- compliance officer, 231
- CompTIA Security+, 435
- conferences, as resources, 436
- confidentiality, in secure wireless architecture, 13–14
- configurations, managing, 309–313
- connectivity, issue of, 41
- Connectivity Standards Alliance, 475
- consultants, 271
- consumerization, 339
- contractors, 544–547
- control plane security, 321–322
- Controlled Port function, 106
- credential vaulting, 301–303
- credentials
- cryptography
- data paths
- about, 56–57, 71
- bridged, 59–61
- controlling guest portals with DNS on wireless, 66–67
- filtering
- with ACLs on routing devices, 68–70
- with ACLs on wireless, 65–66
- with inter-station blocking on wireless, 64–65
- with network virtualization overlay on wired infrastructure, 71
- with policies on firewalls, 70–71
- with SSIDs/VLANs on wireless, 65
- with VLANs on switches, 67–68
- within wireless/wired infrastructures, 63–64
- dedicated systems, 379–383
- Defense Federal Acquisition Regulation Supplement (DFARS), 6
- Define phase, in Design for Six Sigma (DFSS), 223–224
- denial of service (DoS) attempts, 390
- deployment architectures, 484
- design. See planning and design
- Design for Six Sigma (DFSS), 222–227, 254
- Design phase, in Design for Six Sigma (DFSS), 225
- devices, authentication of, 25–26, 469
- DHCP services
- Diameter, 118
- Diffie-Hellman Ephemeral Key Exchange (DHE), 83
- digital signature algorithm (DSA), 83
- direct routing, 506
- directories, server settings for, 430–431
- direct-routed products, 459–460
- disconnecting messages, 123–127
- Discover stage, in Design for Six Sigma (DFSS), 223–224
- discovery protocols, 213–215
- distribution of users, 37–43
- DNS beaconing, 180
- DNS cache poisoning, 180
- DNS hijacking, 180
- DNS services
- E
- edge IP protocols, 505–506
- edge ports, securing access to, 332–334
- edge switch, 326, 329
- e-discovery, 450
- 802.1AR, 285
- 802.1X
- about, 26, 29, 33–34, 35, 36, 77, 102–107, 327, 425–428
- best practices for using certificates for, 152–158
- configuring with Microsoft NPS, 513–520
- deciphering acronyms of 192-but Mode, 83–84
- endpoint device certificates for, 151–152
- enhancements with WPA3-Enterprise, 82
- history of, 105
- options for, 79–81
- planning Enterprise (802.1X) Secured SSIDs, 77–79
- RADIUS server certificates for, 148–151
- terminology in, 103–104
- WPA2 to WPA3-Enterprise Migration recommendations, 85–87
- WPA3-Enterprise 192-bit Mode, 82–83
- 802.1X Authenticator, 103
- 802.1X Supplicant, 103
- 802.11 standard, 32, 95, 272, 523–524
- 802.11R, 321
- 802.11w. See Wi-Fi Protected Access version 2 (WPA2); Wi-Fi Protected Access version 3 (WPA3)
- Ekahau Pro, 413
- elliptic curve cryptography (ECC), 84
- Elliptic Curve Diffie-Hellman Ephemeral Key Exchange (ECDHE), 83
- Elliptic Curve Digital Signature Algorithm (ECDSA), 83
- emergent trends
- employee lifecycle, 451
- encoding, 378–379
- encrypted frames, 319
- encrypted management protocols, enforcing, 283–293
- endpoint device certificates, for 802.1X, 151–152
- endpoints
- end-user support roles, 9
- Enhanced Interior Gateway Routing Protocol (EIGRP), 217
- enhanced open networks, changes in roaming facilitation with, 200–201
- enterprise risk management, 16
- Epiq Solutions, 404
- executive leadership, 267–279
- extended detection and response (XDR), 408, 409–410
- Extensible Authentication Protocol (EAP)
- about, 103–104
- EAP-FAST (Flexible Authentication via Secure Tunnel), 130
- EAP-GTC (Generic Token Card), 135–136
- EAP-MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2), 135
- EAP-PEAP (Protected EAP), 129–130
- EAP-POTP (Protected One-Time Password), 136–137
- EAP-TEAP (Tunneled EAP), 131
- EAP-TLS (Transport Layer Security), 134–135
- EAP-TTLS (Tunneled Transport Layer Security), 130
- methods for authentication, 127–140
- Mutual Cryptographic Binding, 522
- securing tunneled, 132–133
- support for, 132
- unsecured methods, 137–138
- H
- handheld testers, 410–412
- hardening
- hardware-based IDs, certificate tied to, 285
- hash functions, 28, 314
- hash-based message authentication code (HMAC), 83
- headless devices, 36, 539–544
- Health Insurance Portability and Accountability Act (HIPAA), 6, 369
- help desk, 8–9, 232
- hiding SSIDs, 356–359
- home automation, 475–477
- honeypot AP, 393
- HTTPS, enabling, 287–288
- I
- IANS Research, 274
- IBwave, 414
- identification, in InfoSec, 24
- identity and access management (IAM), 8, 231
- illegal activity, 451
- industrial automation, 501–502
- InfoSec, 24
- infrastructure devices, locking access to, 334–337
- infrastructure hardening, as a planning and design output, 251
- inner authentication methods, 133–137
- inputs
- Institute of Electrical And Electronics Engineers (IEEE)
- integrity, availability, and confidentiality (IAC) Triad, 11–14
- integrity group transient key (IGTK), 318–319
- internal access
- internal domain CAs, certificates issued from, 286
- International Telecommunication Union (ITU-R), 32
- Internet Engineering Task Force (IETF)
- Internet of Things (IoT)
- layer 3 roaming mobility domains, 217
- LDAP authentication, for Wi-Fi, 168
- leased licensed spectrum, 489
- legacy EAP methods, 137–138
- legacy open authentication networks, 94–95
- Let's Encrypt, 153
- Link Layer Discovery Protocol (LLDP), 213–215
- LLDP Media Endpoint Discovery (MED), 213–215
- local area networks (LANs), 505
- local server authentication, 328
- location
- M
- MAC address
- MAC Authentication Bypass (MAB)
- malformed packets and fuzzing, 388
- managed user, with managed device, 533–539
- management access
- about, 282–283
- additional considerations, 307–308
- addressing privileged access, 303–307
- controlling administrative access and authentication, 296–301
- eliminating default credentials and passwords, 293–296
- endpoints and, 237
- enforcing encrypted management protocols, 283–293
- securing shared credentials and keys, 301–303
- mesh topology, 507
- MetaGeek Wi-Spy +Chanalyze, 402
- metropolitan area networks (MANs), 505
- Microsoft NPS, configuring 802.1X with, 513–520
- migration strategies, 76–77
- misconfigured AP, 384
- mobile device management (MDM), 25
- modulation, 378–379
- monitoring and maintenance
- logging best practices, 416–424
- ongoing, 376
- penetration testing, 375–376
- reporting best practices, 416–424
- scheduled, 203–204
- security audits, 368–370
- security logging and analysis, 407–410
- security testing and assessments, 367–376
- synthetic testing and performance monitoring, 405–407
- tools for, 376–416
- training and resources, 432–437
- troubleshooting security, 424–432
- vulnerability assessments, 370–373
- wireless intrusion prevention systems (WIPS), 377–405
- wireless-specific tools, 410–416
- N
- NAS-IP-Address, 111
- NAS-Port, 112
- NAS-Port-Type, 112
- National Institute of Standards and Technology (NIST)
- network architects, 4–5, 232
- network closets, 331–332
- network operations teams, 9, 232
- Network Planning Template, 261–262
- network protocol analyzers, 415
- network security training, 435
- network services
- Network Time Protocol (NTP), 175–176
- network topology, 37–43, 502
- neutral host networks (NHNs), 498–499, 560–561
- “The New Future of Work” report, 442–443
- NodeBs, 496
- non-802.11 wireless technologies, 465–508
- non-user-based devices, 36, 539–544
- North American Energy Regulations Commission (NERC), 6, 305
- numeric comparison, 472
- O
- onboarding, troubleshooting, 431
- 192-bit mode, 82–84, 85
- on-prem products, 459–460
- open authentication networks
- Open Shortest Path First (OSPF), 217
- Open Wi-Fi security, 34
- operating system, endpoints and, 236–237
- operations roles, 8–9
- opportunistic key caching (OKC), 196–197
- Opportunistic Wireless Encryption, 522
- Optimize phase, in Design for Six Sigma (DFSS), 226–227
- organizational risk, aligning wireless architecture security to, 14–16
- organizational security requirements, as a planning and design input, 233–235
- Orr, Stephen, 216
- OUI Lookup Tool, 386
- out of band (OOB) pairing, 472
- outer EAP tunnels, 129–132
- outputs
- P
- packet analysis, of Fast Transition, 200
- pairwise master key (PMK) caching (roam-back), 194–196
- passkey entry, 472
- passwords
- patches, verifying software integrity for, 314–316
- Payment Card Industry Data Security Standard (PCI DSS), 6, 17, 369, 528
- payment gateways, captive portals for, 167
- Payment Services II Directive (PSD2), 369
- peer-based zero configuration networking, 346–347
- peer-to-peer communications, controlling, 339–353
- penetration testing, 375–376
- performance monitoring, 405–407
- personal area networks (PANs), 504
- personal devices. See bring your own device (BYOD)
- personal mode (passphrase with PSK/SAE), 87–93
- personal networks, 73
- personal (passphrase) Wi-Fi security, 35
- physical layer, 503–504
- physical security, planning, 331–337
- planning and design
- Policy Decision Point (PDP), 456
- Policy Enforcement Point (PEP), 456
- Policy Matrix, 262
- port entities, 104
- portals, troubleshooting, 431
- pre-shared keys (PSKs), 275–276
- private cellular, 272, 481–499
- private WANs, 499–501
- privileged access
- privileged access management (PAM), 305–307
- privileged accounts and credentials, securing, 303–305
- procedures, role of, 19–21
- processes
- production networks, Fast Roaming and, 201
- protected frame types, 318–319
- Protected Management Frames (PMFs)
- protocol-translated IoT, 465
- proxy, DHCP through, 183
- public cellular, for IoT, 477–481
- Public Key Infrastructure (PKI)
- public/private key pairs, keys generated on devices using, 286
- R
- radio resource management (RRM) protocols, 205–206
- radios, 378–379
- RADSEC, 118, 121
- rate limiting Wi-Fi, 208–213
- registration, troubleshooting, 431
- regulatory requirements, 17–19
- Regulatory Technical Standards for Secure Customer Authentication (RTS SCA), 369
- remote AP hardware, 41–42
- Remote Authentication Dial-In User Service (RADIUS)
- about, 26, 104, 297–299
- accounting for, 122–123
- attributes for, 111–114
- Attributes for IEEE 802 Networks, 522
- authentication server that supports, 517–520
- clients, 118–119
- 802.1X/EAP and, 425–428
- MAC authentication bypass with, 140–147
- MAC authentication without, 147
- policies for, 116–118
- security for, 121
- server certificates for 802.1X, 148–151
- server settings, 430–431
- servers, 107–110, 118–121
- shared secrets, 120
- types, 522
- vendor-specific attributes, 115–116
- remote branch environments, 39
- remote Wi-Fi VPN Client, 42–43
- remote worker environments, 40–41
- remote workforce, as an emergent trend, 441–445
- reporting
- rogue AP, 384, 392
- rogue client, 384
- rogue detection, 355–356
- roles and responsibilities
- about, 4
- Chief Information Security Officer, 6–7
- end-user support, 9
- help desk, 9
- identity and access management (IAM), 8
- network architects, 4–5
- network operations teams, 9
- risk and compliance, 5–6
- security operations/analyst, 7–8
- supply chain security, 10–11
- technology manufacturers and integrators, 10
- vendor management, 10–11
- wireless architects, 4–5
- rollback support, 312–313
- S
- SANS, 435
- Sarbanes-Oxley (SOX), 305, 369
- scheduled downtime, 203
- scheduled maintenance, 203–204
- scheduled testing, 203–204
- scope of work/project, as a planning and design input, 228–230
- secure file transfers, enabling, 290
- Secure Hash Algorithm (SHA-384), 83
- securing tunneled EAP, 132–133
- security. See also specific topics
- about, 10
- aligning to organizational risk, 14––16
- assessments of, 373–374
- authentication, 23–27
- of captive portals, 163–167
- compliance requirements, 17–19
- cryptography, 27–29
- of devices, 37
- distribution of users, 37–43
- DNS, 179–180
- endpoint devices, 35–37
- endpoints and, 238
- IAD Triad, 11–14
- logging and analysis of, 407–410
- monitoring, 355–356
- network topology, 37–43
- on open vs. enhanced open networks, 167
- for RADIUS, 121
- regulatory requirements, 17–19
- role of policies, standards, and procedures, 19–21
- segmentation, 22–23
- SSID security profiles, 34–35
- wireless standards and protocols, 30–34
- security analyst, 231
- security audits, 368–370
- security information and event management (SIEM), 7, 408, 409
- security operations centers (SOCs), 7–8, 231
- security orchestration, automation, and response (SOAR), 7, 408, 409
- Security Transition Modes, 565
- segmentation
- service set identifiers (SSIDs)
- about, 34, 72–73, 98–99, 188–189
- enterprise mode (802.1X), 77–87
- enterprise-secured networks (802.1X), 35
- guidance on, 550–551
- hiding and cloaking, 356–359
- impersonation, 385
- inter-station blocking, 344–346
- migration strategies, 76–77
- open authentication networks, 94–98
- Open Wi-Fi security, 34
- personal mode (passphrase with PSK/SAE), 87–93
- personal (passphrase) Wi-Fi security, 35
- as a planning and design output, 247–249
- transition modes, 76–77
- WPA2/WPA3, 73–76
- 7Signal, 407
- shared credentials and keys, 301–303
- shared/coordinated spectrum, 489
- Sigfox, 500
- Signal Hound, 404
- Simple Network Time Protocol (SNTP), 175–176
- 6loWPAN, 476–477
- smart building, 475–477
- SNMP, removing default strings, 296
- SNMPv2c, 296
- SNMPv3, 291–293
- software
- T
- TACACS+, 26, 297–299
- TalentLMS, 443
- tamper-evident labels (TELs), 337
- teams involved, as a planning and design input, 230–233
- Tech Field Day, 436
- technical elements, 45
- technical leadership, 267–279
- technology
- third parties, 271, 544–547
- third-party CAs, certificates issued from, 286
- Thread, 476–477
- 3GPP (3rd Generation Partnership Project), 32
- tiered hardening, 353–354
- time sync services
- tools. See also specific tools
- training resources
- U
- Uncontrolled Port function, 106
- Universal Plug-n-Play (UPnP) protocols, 350–351
- unlicensed spectrum, 489
- unprotected frametypes, 317–318
- unsecured EAP methods, 137–138
- upgrades, verifying software integrity for, 314–316
- uptime, 203
- user directories, 121
- user-attachment, endpoints and, 237
- user-based devices, 36
- user-based logons, enforcing, 297–299
- users
- W
- wide area networks (WANs), 505
- Wi-Fi
- design impacts on security, 187–217
- future of, 559–561
- infrastructure that supports Enterprise (802.1X) SSID security profiles, 513–514
- LDAP authentication for, 168
- management frames, 317
- network services for, 173–187
- rate limiting, 208–213
- recommendations for Fast Roaming in secure, 201–202
- recommended EAP methods for secure, 138–140
- 6E, 207–208
- time sync services in, 175–177
- training and certification, 433–434
- Wi-Fi Protected Access version 3 (WPA3)
- about, 73–75, 319–320
- benefits of Protected Management Frames (PMF), 75–76
- changes in roaming facilitation with, 200–201
- cipher suites, 79–80
- considerations for, 320
- determining length of passphrases, 555–558
- enhancements with, 82, 88–92
- guidance on, 549–550
- headless devices on, 541, 543
- migration recommendations, 85–87, 92–93
- 192-bit mode, 82–83
- Personal Only Mode, 91
- Personal Transition Mode, 91
- protected management frames, 316–321
- Transition Mode, 85–86
- using with 802.11R, 321
- Wi-Fi Protected Access-Enterprise (WPA-Enterprise)
- Wi-Fi Protected Access-Personal (WPA-Personal)
- Wi-Fi VPN Client, remote, 42–43
- Wi-Fi-enhanced open authentication networks, 95–98
- wildcard certificates, 153
- Windows, Fast Transition support and, 199
- wired infrastructure
- wireless architects, 4–5, 268
- wireless bridges, 390
- wireless infrastructure and operations
- about, 45–46, 55–56
- architectures with cloud management, 50–51
- authentication of components, 26–27
- cloud-managed benefits, 48–49
- connection type
- control plane, 46–47
- controller managed Wi-Fi, 52–53
- data plane, 47–48
- LAN services, 39–40
- local cluster managed Wi-Fi, 53–54
- management
- wireless intrusion detection systems (WIDS), 377–378
- wireless intrusion prevention systems (WIPS)
- X
- X.509, 150
- Z
- zero touch provisioning (ZTP), 42
- zero trust
- Zigbee, 475
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.