Network Security
Beginner 15 min read Network Security
Wireless Security
Secure the weakest physical layer: WPA2 vs WPA3, rogue access points, evil twins, and how to protect an org's airspace without a physics degree.
WPA2WPA3802.1Xrogue APevil twinairspacewireless
Introduction
What is this?
Wireless security controls who connects to your radio waves and what they can see: encryption keys, client authentication, and detection of unauthorized or deceptive access points.
Motivation
Why do you need it?
- Wi-Fi is radio: nothing stops the signal being received by a stranger with a receiver, so encryption and authentication earn their keep here first.
- Rogue/evil-twin APs are a top wireless incident; a split-second intervention saves a network age of pain.
- WPA2-to-WPA3 migration is happening right now in every fleet — knowing handshake details is current, not trivia.
Think about it
Mental model
Imagine
Wi-Fi airwaves
Think of
Loudspeaker conversations in a crowded room
Everyone can hear it; the lock is the envelope (encryption), not the room.
Mechanics
How it works
- WPA2/3 handshake derives a pairwise key from the PSK or (better) enterprise 802.1X authentication to a RADIUS server.
- Enterprise mode binds each client to an identity + credentials — revocation and MFA become possible per user.
- A rogue AP advertises a trusted SSID; clients auto-associate, and the fake AP becomes a man-in-the-middle.
- WDS/802.11r and PMK caching shorten roaming; monitoring role (WIDS) walks the airwaves for frames that shouldn't exist.
Enterprise (802.1X) authentication walk
Probeclient sees SSID
Associateradio link up, no crypto yet
EAPidentity + credentials over RADIUS
Keyradius success + pairwise keys derived
Dataencrypted unicast/multicast traffic
Real world
In production
- A hotel replaces shared WPA2-PSK with per-room enterprise credentials so no guest can sniff another's traffic.
- A manufacturing plant runs WIDS that alerts when a kiosk starts advertising the plant SSID with a huge signal — the rogue scanner.
- A school splits guest and staff SSIDs on separate VLANs so guest clients can never reach admin printers.
Guidelines
Best practices
- Use WPA3 (SAE) where clients support it; enable enterprise/802.1X rather than shared PSKs for mixed fleets.
- Put guest networks on their own SSID/VLAN with internet-only egress and daily PSK rotation.
- Disable WPS and legacy pre-WPA2 modes outright; they are structured holes.
- Run wireless monitoring (WIDS) or scheduled surveys for rogue APs and evil twins on critical SSIDs.
Watch out
Common mistakes
- Reusing the same PSK across SSIDs and sites — one leak is a universal key.
- Enabling WPS 'for convenience' and neutering WPA2's resistance.
- Placing guest and staff on the same VLAN while telling yourself 'the SSID separates them'.
- Assuming 'hidden SSID' means security; beacon hiding removes nothing from an attacker.
When things break
Debugging tips
- nmcli dev wifi list with your own client shows the SSIDs you actually advertise; a double-match is the first hint of a twin.
- When enterprise clients fail intermittently, check RADIUS timeouts and client certificate expiry, not the radio.
- Compare signal strength and BSSID between your AP and the suspicious one — an evil twin is usually another name on the same channel.
Security
Security considerations
- Only scan/augment your own airspace; monitoring others' networks (even 'just looking') crosses legal lines.
- Store per-site Wi-Fi secrets in a vault, and alert on WPA-PSK credential rotation.
- Tie wireless identity to HR offboarding: a departed employee's enterprise Wi-Fi access must die instantly.
Interviews
Interview checkpoint
Test yourself
Quick quiz
0/2
1
Which wireless mode lets you revoke a single user's access without rotating the shared secret?
2
An attacker sets up an AP with your SSID to intercept clients. This is called...
Go deeper