Lake Point Consulting Services (LPCS) provides security consulting and assurance
ID: 3891503 • Letter: L
Question
Lake Point Consulting Services (LPCS) provides security consulting and assurance services to over 500 clients across a wide range of enterprises in more than 20 states. A new initiative at LPCS is for each of its seven regional offices to provide internships to students who are in their final year of the security degree program at the local college.
Pomodoro Fresco is a regional Italian pizza chain that provides free open wireless access to its customers and secure wireless access for its staff. However, Pomodoro Fresco is concerned about the security of the WLAN. They have asked LPCS to make a presentation about wireless attacks and their options for security. LPCS has asked you to help them in the presentation.
Create a PowerPoint presentation for the staff about the threats against WLANs and the weaknesses of the IEEE 802.11 security protocols. Also, include information about the more secure WPA2. Your presentation should contain at least 10 slides.
After the presentation, Pomodoro Fresco is trying to decide if they should install a captive portal for their customer WLAN. Create a memo to their management outlining the advantages and disadvantages, along with your recommendation.
Explanation / Answer
WLAN (Wireless LAN) is used everywhere as it is flexible, movable and easy to access and manage.
Equipment:
WLan has access points and Network Interface Cards where access points provides the wireless connection to the client who has NIC and this communication is established using MAC addresses of each other.
Security threats involved in WLAN
Attack on Service Set Identifier:
SSID is the Id provided to the WLAN by Access Point and then authorized ssid devices are asked for passwords. Where these services are spoofed and intruder tries to behave like a client.
DOS (Denial Of Service) :
In this intruder floods the network with valid or invalid messages such that network cannot connect or provide any services to the real client.
Spoofing and Session Hijacking:
In this intruder spoofs the MAC (Machine Access Control) of the network provider and force connects the clients to itself, thus session is hijacked.
Eavesdropping:
In this intruder sniffs the network packets such that confidential data is catched as the wireless sends the data into the air.
Man in the middle attack:
In this intruder acts as network provider to the client and imitates the client to the network provider such that spoofing both the addresses and sniffs the packets and gathers all the important data.
Attack on Service Set Identifier:
SSID is the Id provided to the WLAN by Access Point and then authorized ssid devices are asked for passwords. Where these services are spoofed and intruder tries to behave like a client.
WEP (Wired Equivalent Privacy ): It is a data encryption, user authentication based on the pre-established and shared base key.
WPA (Wi fi Protected Access ) can be accessed in two modes enterprise and personal mode.
Personal mode uses pre-shared key and less secured than enterprise mode. Temporal key integrity protocol is an encryption method used in pre-shared key.
Weakness:
Encryption used is very weak (RC-4).
Over all network transmission spped is affected due to the cryptographic techniques implemented for each packet.
Incompatible to the older OS (Operating Systems).
WPA2 :
This is new security standard developed to patch the WEP and WPA this used Robust Security Network concept.
This security framework includes the two encryption protocols.
TKIP is replaced with CBC-MAC protocol.
Weaknesses:
Vulnerable to the insider attacks as it shares a Group Temporal Key with all authorized clients.
Captive Portals : These are used as login and acknowledgement portals. New user has to register and provide the details to access the network and get internet access. It also provides agreement policies to sign such that user cant violate those rules.
Even some portals use social media details to provide network.
Weaknesses:
In this way users private details are collected such that network provider get access to their details.
I recommend to use captive portal to access open wifi.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.