Chapter 15 — Wireless security
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Staff wireless"]
N2["15.2 Guest wireless"]
N3["15.3 Unauthorised access points"]
N4["15.4 Settings"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Staff wireless"]
N2["15.2 Guest wireless"]
N3["15.3 Unauthorised access points"]
N4["15.4 Settings"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Staff wireless]
|
v
[15.2 Guest wireless]
|
v
[15.3 Unauthorised access points]
|
v
[15.4 Settings]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) configure secure wireless networks; (2) separate guest and staff wireless; (3) find unauthorised access points.
15.1 Staff wireless
Riverbend's staff wireless uses a single password shared by everyone and unchanged for years, known to many former staff. Jamal recommends individual sign-in for staff wireless using their normal accounts, so leavers lose wireless access when their account is disabled. Where devices cannot support this, such as some tablets used for class registers, he recommends a separate network with a strong password changed every term. The IT manager configures individual sign-in at one centre as a trial and extends it to all centres after a month. The register tablets move to their own network with a new password.
15.2 Guest wireless
Members use guest wireless in cafés and lounges. Jamal checks that the guest network is separated from staff and till networks and that guests cannot see each other's devices. He also checks the guest welcome page, which asks for an email address. He suggests explaining how the address is used and offering access without it. Ms. Grant notes that guest networks must be isolated, because Riverbend cannot control what devices guests bring. The marketing manager agrees to update the welcome page wording within a month.
15.3 Unauthorised access points
Jamal walks through two centres with a laptop listing nearby wireless networks. He finds an access point named like a staff network but not installed by IT. It turns out the café supplier installed it for their card terminal. It connects to the staff network directly. He reports it, and the IT manager arranges for the supplier's terminal to use a proper separated connection. Jamal learns that unauthorised access points often come from suppliers solving their own problems. He adds a wireless check to his visits.
15.4 Settings
Jamal checks wireless settings: modern encryption enabled, old protocol versions disabled, management interfaces not reachable from guest networks and firmware updated. One centre's access point still allows an old, weak encryption mode for compatibility with an old printer. He moves the printer to a wired connection and disables the weak mode. Ms. Grant notes that compatibility settings often keep weaknesses alive long after they are needed. He records the settings for each access point in the network documentation, so the IT manager can check them after any change or firmware update.
Worked example
Jamal replaces a shared staff wireless password with individual sign-in, checks guest isolation, finds a supplier access point bridging to the staff network and removes a weak encryption mode.
Synthetic case. Networks are synthetic.
Errors and limits
Shared wireless passwords remain known to former staff.
Exercises
- EX043 — Shared password problem. Why is the shared staff wireless password a problem? Rubric: 3 = known to former staff;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX044 — Rogue access point. Who installed the unauthorised access point? Rubric: 3 = the café supplier;; 2 = partly correct;; 1 = other;; 0 = none.
- EX045 — Weak mode. Why was a weak encryption mode enabled? Rubric: 3 = for an old printer;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 15 (chapter 15 of 30)
← Chapter 14 · Course chapter index · Chapter 16 →
Continue to the next authored lesson.