LockInCS

Topic 3.2 · Unit 3: Securing Networks · 20 minute session

3.2 Protecting Networks: Managerial Controls and Wireless Security

Managerial controls for networks are security policies that set minimum standards for routers, switches, virtual private network (VPN) access and wireless networks. Wireless networks are then configured to match: disable beacon broadcasting, limit signal direction and strength, use strong encryption such as Wi-Fi Protected Access 3 (WPA3) instead of Wired Equivalent Privacy (WEP), Wi-Fi Protected Setup (WPS) or the original WPA, and use media access control (MAC) filtering and authentication to keep unauthorized devices out.

Big idea Policies decide what every network device must look like; configuration makes it true.

Course and exam description (CED) codes covered: 3.2.A.13.2.A.23.2.A.33.2.A.43.2.B.13.2.B.23.2.B.33.2.B.4

Last reviewed against the CED:

By the end of this session you can

  • 3.2.A Identify managerial controls related to network security.
  • 3.2.B Configure wireless network security features.

Already know this? Jump to the checkpoint.

New to beacon frames and access points? The Networking Basics wireless session covers them.

1. Network security policies (3.2.A)

Policies are managerial controls: they set the minimum standard every device must meet.

Policy Typical requirements
Router security policy 3.2.A.1 Ban local user accounts (logins go through an approved authentication server). Disable unnecessary services, such as Telnet. Require a firewall, which may be a separate device.
Switch security policy 3.2.A.2 Ban local user accounts. Require port security. Use MAC filtering.
Virtual private network (VPN) policy 3.2.A.3 List the roles allowed to use the VPN. Set authentication requirements, such as a public and private key system or multifactor authentication (MFA). Prohibit split tunneling (also called dual tunneling).
Wireless security policy 3.2.A.4 Users authenticate through the extensible authentication protocol (EAP) to an approved server. All wireless traffic is encrypted with the Advanced Encryption Standard (AES) at a minimum key length. Beacon frames are disabled on access points.

Why ban local accounts? A local account lives only on that one device, so it escapes central control: nobody reviews it, and it often keeps a weak or default password. An approved authentication server keeps every login in one managed place.

2. Configuring wireless security (3.2.B)

  • Disable beacon frame broadcasting on wireless access points (WAPs), so adversaries have a harder time finding the network and learning its basic properties 3.2.B.1.
  • Control broadcast direction and signal strength, so the signal does not reach beyond the space the access point should cover 3.2.B.2.
  • Enable strong encryption, so intercepted wireless frames cannot be read 3.2.B.3:
Protocol Status
WEP (Wired Equivalent Privacy) Insecure: known vulnerabilities
WPS (Wi-Fi Protected Setup) Insecure: known vulnerabilities
WPA (original Wi-Fi Protected Access) Insecure: known vulnerabilities
WPA3 Currently the strongest
  • Enable MAC filtering to keep unauthorized devices off the network, and require users to authenticate when they join 3.2.B.4.

Prevent: each setting answers an attack from 1.3 or 3.1. MAC filtering and authentication counter rogue devices, WPA3 counters eavesdropping on wireless frames, and limiting the signal counters war driving from outside.

Now audit a real-looking router configuration against the policy.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

  • Network policiesFour policies, one idea: no local accounts, only what you need, and prove who you are.
  • Wireless settingsHide it, shrink it, scramble it, screen it: hide beacons, shrink the signal, encrypt with WPA3, filter by MAC.
  • Insecure protocolsW, W, W: WEP, WPS and the original WPA are all weak. Go 3.

Common misconceptions

  • "WPA is fine because it is newer than WEP."

    Not quite. The original WPA, along with WEP and WPS, has known vulnerabilities and is insecure. WPA3 is currently the strongest wireless encryption.

  • "A policy is a technical control because it is about routers."

    Not quite. A policy sets rules for how devices must be configured, so it is a managerial control. The settings it requires, such as port security, are the technical controls.

  • "Turning up the access point's signal is always better."

    Not quite. A signal that reaches the parking lot helps adversaries. Control direction and strength so the signal covers only the intended space.

Simulation · [3.2.A.1, 3.2.A.2, 3.2.A.4, 3.2.B.1, 3.2.B.3]

Config audit: which settings break the security policy?

The policy says: no local user accounts, no unnecessary services, port security on, WPA3 (AES) encryption, beacon frames off. Tap every setting that breaks it.

branch-router-02# show running-configswipe sideways for more

  1. Fine. Logins go through the approved authentication server. This is what the policy wants.

  2. Red flag. A local user account, with a weak patterned password too. The policy bans local accounts.

  3. Red flag. Telnet is an unnecessary service (and sends logins unencrypted). The policy says disable it.

  4. Fine. Port security is on: one MAC address per port, which stops MAC flooding.

  5. Red flag. The policy requires WPA3, the strongest wireless encryption.

  6. Red flag. Beacon broadcasting is on. The policy says disable beacon frames so the network is harder to find.

  7. Fine. A firewall is required by the router policy, and it is on.

Exam traps

  • A policy is a managerial control even when it is about routers. The settings it requires are technical controls.
  • WEP, WPS and the original WPA are all insecure. Only WPA3 is named the strongest.
  • Banning split tunneling is part of a VPN policy, not a wireless policy.

By the numbers

Say each list out loud, then tap to check.

4 policies Say them, then tap
3 router rules Say them, then tap
  • no local accounts
  • disable unnecessary services such as Telnet
  • require a firewall
3 switch rules Say them, then tap
3 VPN rules Say them, then tap
  • allowed roles
  • authentication requirements
  • no split tunneling
3 wireless rules Say them, then tap
  • EAP to an approved server
  • AES with a minimum key length
  • beacon frames disabled
4 wireless settings Say them, then tap
  • disable beacons
  • limit direction and strength
  • WPA3
  • MAC filtering plus authentication

In 30 seconds

  1. Router policy: no local user accounts (use an approved authentication server), disable unnecessary services such as Telnet, require a firewall.
  2. Switch policy: no local user accounts, port security on, MAC filtering.
  3. VPN policy: which roles may use the VPN, authentication requirements (keys or MFA), no split tunneling.
  4. Wireless policy: EAP authentication to an approved server, AES encryption with a minimum key length, beacon frames disabled.
  5. Configure: disable beacon broadcasting, control signal direction and strength, use WPA3 (not WEP, WPS or original WPA), MAC filtering plus user authentication.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Checkpoint · 6 questions

Checkpoint: Managerial Controls and Wireless Security

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. 1 A router security policy requires that all router logins use an approved authentication server. Which setting breaks this policy? 3.2.A.1
    Show answer

    Answer: C. Router policies ban local user accounts; logins must go through an approved authentication server.

  2. 2 Which service would a router security policy most likely require to be disabled as unnecessary? 3.2.A.1
    Show answer

    Answer: C. Router policies may require disabling unnecessary services, such as Telnet.

  3. 3 A virtual private network (VPN) policy prohibits split tunneling. What does this prevent? 3.2.A.3
    Show answer

    Answer: A. VPN policies may prohibit split tunneling (also called dual tunneling), where traffic is split between the VPN and a direct internet connection.

  4. 4 Which wireless encryption protocol is currently the strongest? 3.2.B.3
    Show answer

    Answer: D. WEP, WPS and the original WPA have known vulnerabilities and are insecure. WPA3 is currently the strongest.

  5. 5 War drivers detect a company's Wi-Fi signal from the street. Which configuration change addresses this most directly? 3.2.B.2
    Show answer

    Answer: B. Controlling broadcast direction and signal strength keeps the signal inside the physical space the access point should cover.

  6. 6 Which pair of settings makes a wireless network both harder to find and harder for unknown devices to join? 3.2.B.1, 3.2.B.4
    Show answer

    Answer: C. Disabling beacon frames makes the network harder to find; media access control (MAC) filtering and authentication keep unauthorized devices off.

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

  • Router security policytap to flip

    A managerial control that sets the minimum configuration standard for routers, such as banning local accounts, disabling unnecessary services and requiring a firewall.

    Example and CED codes
  • Port securitytap to flip

    A switch feature that limits how many media access control (MAC) addresses can be assigned to a single switch port.

    Example and CED codes
  • MAC filteringtap to flip

    Allowing only devices with approved media access control (MAC) addresses to join a network or use a switch port.

    Example and CED codes
  • Split tunnelingtap to flip

    A virtual private network (VPN) setup where some traffic goes through the VPN and some goes directly to the internet at the same time; VPN policies often prohibit it.

    Example and CED codes
  • Extensible authentication protocol (EAP)tap to flip

    A framework that lets users authenticate to a wireless network through an approved authentication server, required by many wireless security policies.

    Example and CED codes
  • WPA3tap to flip

    Wi-Fi Protected Access 3, currently the strongest wireless encryption protocol; Wired Equivalent Privacy (WEP), Wi-Fi Protected Setup (WPS) and the original Wi-Fi Protected Access (WPA) have known vulnerabilities.

    Example and CED codes
  • Beacon frametap to flip

    A frame a wireless access point broadcasts several times a second to announce its service set identifier (SSID) and wireless encryption protocols.

    Example and CED codes
  • Wireless access point (WAP)tap to flip

    A device that connects wireless devices to a wired local area network (LAN) by radio and announces the network in beacon frames.

    Example and CED codes
  • Virtual private network (VPN)tap to flip

    A service that encrypts all your traffic to the VPN operator's system, hiding it from the local network and service provider but not from the VPN provider.

    Example and CED codes

Questions students ask

Which wireless encryption protocols are insecure in AP® Cybersecurity?

WEP, WPS and the original WPA have known vulnerabilities and are insecure. WPA3 is currently the strongest.

What is split tunneling and why do VPN policies ban it?

Split tunneling, also called dual tunneling, lets a device send some traffic through the VPN and some directly to the internet at the same time. VPN policies often prohibit it so all traffic to and from the internal network stays protected.

Why disable beacon frames on an access point?

Beacon frames announce a wireless network and its basic properties. Disabling them makes the network harder for adversaries to find and learn about.

↑ Top

Enlarged view of the selected figure