Certified Wireless Security Professional (CWSP)

Explore how standards organizations like ISO, IEEE, IETF, and the Wi-Fi Alliance shape OSI compatibility, interoperability, and certification for wireless networks.

Demonstrate the OSI model from application to data link, compare wired and wireless media, and explain securing layer one and two traffic, including MAC addressing, segmentation, IP addressing, and routing.

Explore the ISOC hierarchy, from the internet architecture board and IETF to ICANN and IRTF, and see how collaborative RFCs shape secure internet protocols.

Explore Wi-Fi standards evolution from 802.11a/b/g/n/ac, compare 2.4 GHz and 5 GHz bands, and cover Wi-Fi Alliance certification, WPA/WPA2, WMM QoS, power save, and converged RF concepts.

Explore how 802.11 wireless basics map to OSI layers 1 and 2, outlining access, distribution, and core layers and how wireless and wired networks interconnect to support secure traffic.

Understand how access layer switches and wireless access points connect users, then move traffic through distribution and core layers toward servers or the cloud, highlighting access layer security.

Explore wireless connection types like point-to-point bridges and point-to-multipoint networks with controllers. Authenticate users via an active directory server or a radio server, and note anonymous access.

Explore data privacy in radio frequency communications, noting unlicensed bands are easy to intercept, and learn how encryption and key strength protect the sender and receiver from cryptanalysis.

Monitor wireless networks for performance and intrusion with a wireless LAN controller that detects interference and unknown devices, and centralize logs on a single server to reveal threats.

Explore how regulatory policies shape wireless security, including FIPS 140 cryptography module requirements, government vendor expectations, and corporate policies that train employees to report security incidents.

Trace the security history from 1997 to 2004, examining the wired equivalency protocol's 64/128-bit encryption weaknesses and how attackers cracked networks in minutes.

Explore 802.11i and WPA enhancements, including port-based authentication with 802.1X and EAP, securing access points, servers, and clients, and supporting dynamic keys.

Explore wifi security evolution from open authentication and wep with static keys to wpa with dynamic and temporal keys, to 802.11i and personal and enterprise modes.

Explore the robust security network (rsn) and its associations, focusing on authentication, association, and dynamic key generation. Understand how the four-way handshake creates unique encryption keys for each connection.

Explore the future of 802.11 security with fast roaming through wireless LAN controllers and handoffs. Learn how protected management frames counter denial of service attacks and preserve IP continuity.

Explore networking basics by using ipconfig to reveal wireless and wired layer one through three settings, capture mac addresses, and note IPv4/IPv6 addresses and VLAN considerations.

Explore the web graphical user interface of a Netgear wireless router to review basic settings, wireless channels, security options, logs, and port-based controls.

Examine wireless encryption options from none to wep, wpa, and wpa2, using pre-shared keys and passphrases, and consider enterprise authentication for stronger security.

Provide an overview of wireless security, tracing ISO and OSI origins, Internet society hierarchy, Wi-Fi alliance standards, Aido 211, data privacy, monitoring, policies, and evolution toward 802.11i and WPA.

Explain the authentication and association sequence in wireless networks, from client request to access point association, including open and shared key methods and de jure and de facto standards.

Wep encryption protects traffic by encrypting layers 3 through 7, while mac addresses and ip addresses remain visible, using four hex keys as a pre-shared key without authentication.

Shared key authentication uses a static symmetric key where the access point challenges the client, who encrypts the text to prove the key; a legacy and deprecated approach.

Explore how WEP uses RC4 with a 24-bit initialization vector and 40- or 128-bit keys, exposing key material and illustrating the XOR-based encryption and CRC-based integrity checks.

Explore how VPN protects data, including site-to-site and client-server models, and compare encryption-focused VPN with other types, while noting overhead and tunneling protocols like IPsec and L2TP.

Understand how router-to-router vpn tunnels connect private networks over the internet using public addresses, encryption, hashing, and security associations with diffie helmond key exchange and ike phase one and two.

Examine vpn tunneling protocols, including pptp weaknesses and lack of native encryption, layer two and layer three tunneling, ipsec tunnel mode, and encryption options des, 3des, aes, and diffie-hellman.

Explore mac address filtering, a former layer two security method that restricts access to specific mac addresses and can be spoofed, and is not encrypted.

SSID cloaking offers security by obscurity by hiding the broadcast of the network name, yet it remains discoverable through active scans, probes, or sniffing.

We explore open authentication and wep encryption by configuring and testing an unsecured network and a wep-protected connection, including 64-bit and 128-bit keys.

Explore legacy wireless security by entering hexadecimal 64- and 128-bit keys, testing open authentication and none, and managing saved networks in Windows to remove old credentials.

Demonstrates how MAC spoofing can defeat MAC filtering, shows how to view and change MAC addresses on wired and wireless adapters, and discusses security in depth.

Assess legacy wireless security concepts, including open system authentication, weap encryption, and shared key authentication; examine weap attacks, VPN tunneling, mac filters, and segmentation as precursors to WPA.

Explore how stream encryption runs bit by bit using key streams and XOR, and how block ciphers like DES, triple DES, and AES encrypt 64-bit blocks with key lengths.

Understand why WEP is a legacy encryption system that uses RC4 with a 40-bit key and a 24-bit initialization vector, and why stronger algorithms with longer keys are preferred.

Replace wep with tkip using a dynamic temporal key system and a four-way handshake to create per-client keys, with sequencing, key mixing, mic, and denial-of-service and forgery risks.

Explain how a tkip mpdu is formed, detailing the 32-byte mac header with source and destination addresses, and how the encrypted payload uses temporal keys, iv, and icv for security.

CCMP Part1 overview highlights AES, counter mode with cipher block chaining, and the message authentication code for robust wireless security in WPA2 enterprise or personal setups.

CCMP part2 describes using a 128-bit pairwise transient key for unicast and a group temporal key for multicast, plus 48-bit packet number and a 104-bit nonce with salt for integrity.

Explore CCMP security by tracking unique packet numbers, managing retransmissions, and using additional authentication data from the MAC header to protect frame control fields and deter replay attacks.

Explore how ccmp constructs header from packet number, transmitter address, and priority data. The 128-bit temporal key with S. cypher creates a mic and encrypts data, enabling crc integrity.

Trace how CCMP encrypts data and preserves integrity by building the mac header, creating a nonce from the packet number, and applying a 128-bit temporal key with a key ID.

Explore proprietary solutions, including vendor-specific encryption like 256-bit X sec and Fortress client software, and learn how interoperability challenges in heterogeneous environments limit their usefulness.

Learn how wifi encryption protects data by capturing wireless frames with Wireshark, observing the four-way handshake, key negotiation, and how encrypted data remains unread without the key.

Explain how authentication verifies identity, why usernames and passwords are weak due to social engineering, and how multifactor options—something you know, something you have, and something you are—strengthen WLAN security.

Focus on authentication, authorization, and accounting as the core security trio; prove identity, define user permissions, and audit actions to keep networks safe.

Explore authentication methods beyond usernames and passwords, including one-time passwords and smart cards, and examine digital certificates issued by certificate authorities for tls/https and multi-factor authentication.

Capture and centralize logs from access points and radius accounting servers, enable proactive alerts via siem, and correlate data across devices to detect rogue access and authentication events.

Explore how port-based 802.1X authentication secures wireless access by connecting the supplicant, authenticator (access point), and authentication server using RADIUS, TACACS, LDAP, or EAP to verify credentials and authorize access.

Explore the extensible authentication protocol (EAP), a flexible layer-two method securing communications among the supplicant, authenticator, and server. Learn about EAP over LAN, the four-way handshake, and dynamic key exchange.

The EAP process authenticates a supplicant to an access point via an authenticator, using management frames, identity exchange, radius challenge, and a four-way handshake to establish dynamic encryption keys.

Trace legacy EAP methods like md5-based EAP and LEAP, reveal hashing weaknesses and one-way authentication, and explain deployment across hardware, firmware, and Windows 2000-era networks.

Explore strong EAP protocols with PEAP, using a TLS tunnel for mutual authentication and encrypted sessions, with phase one exchange of identities and certificates, and phase two inner identity validation.

Learn how PACs function as digital certificate–like credentials using pre-shared keys and a Diffie-Hellman based provisioning to establish encrypted tunnels through multi-phase authentication.

Demonstrates how certificates enable and protect wireless security by showing a man-in-the-middle attack with fake and self-signed certificates. It highlights traffic interception and the need to reject invalid certificates.

Explore wireless LAN authentication concepts, including 802.1X port-based authentication, the supplicant, authenticator, and server with shared secrets, while reviewing legacy protocols and EAP types such as PEAP and LEAP.

Explore dynamic WEP, where per-user keys replace static ones. Use seeding material to generate a unicast key, then broadcast keys via radius for encrypted access between the supplicant and authenticator.

Discover how RSN uses a four-way handshake to generate pairwise transient keys for unicast and a group transit key for broadcast, guided by frames ensuring AP-station compatibility and TSN transition.

Learn how management frames negotiate security between station and access point via information exchange information elements (IIS), beacon and probe exchanges, and association requests to establish keys and authentication.

Stations share the same group wise transit key for multicast and broadcast traffic from one access point, with backward compatibility allowing multiple negotiations and unicast key use and tsin support.

Explore authentication and key management (AKM) in wireless networks, detailing discovery, information elements, master key generation (PMK and JMC), the four-way handshake, and deriving pairwise and group translate key.

Illustrate how the authenticator and authentication server establish a secure channel to create pairwise and group keys, enabling the four-way handshake and EAPOL messages for per-station key derivation.

Explore how the authenticator and authentication server establish a secure channel, exchange information elements between access point and supplicant, perform authentication, and begin the four-way handshake to create session keys.

Discover how a master key leads to group-wise and pairwise master keys, creating a pairwise transient key through the four-way handshake, with key encryption keys ensuring data privacy and integrity.

Explore how the master session key is created by the authentication server, shared with the supplicant, and used by the authenticator to derive pairwise and group keys via four-way handshake.

Explore the handshake. See how the authenticator and supplicant exchange nonces to derive the pairwise master key and pairwise transient key, install keys, transfer group keys, and confirm cipher suites.

Explore the four-way handshake, illustrating how random numbers generate a transient key to derive the pairwise key and the back-and-forth messages culminating in the final acknowledgement.

The group key handshake lets the access point derive and distribute a GTK from the group master key, with the supplicant acknowledging via an EAPOL keyframe.

Explore peer key handshake management protocol for secure peer-to-peer communication with the access point, including the master key handshake (SMK) and the four way handshake that derives the transient key.

Explore real-world EAP exchanges through a PCAP capture, observe the four-way handshake, nonce exchange, and key derivation, and learn how promiscuous mode and Wireshark reveal RSN negotiations.

Explore information elements and tagged parameters in wireless LAN management frames, revealing capabilities, data rates, and key management details through beacon captures from an access point and client.

Explore dynamic keys, seekamp, and four-way handshakes in a robust security network, plus authentication and key management from master keys to pairwise transient key and group wise transient key.

for a small office home office, use a strong pre-shared key within the AIM/ACAM framework and avoid server-based solutions; longer passphrases with numbers and symbols boost security.

Passphrases resist dictionary attacks and brute force by using long, mixed-character passwords. Learn how rainbow tables and precomputed hashes drive cracking, and why length and diverse characters strengthen security.

Explain how an ASCII passphrase and the SSID are hashed 4096 times to produce a 256-bit pre-shared key for the 4-way handshake, with nonces and salt creating pairwise transient keys.

Explore the wps registration protocol, including pin and push-button options, in-band and out-of-band exchanges, role discovery, and Diffie-Hellman based two-phase credential provisioning.

Describe the registration mode in wps, detailing phase one: exchange of public keys and roles between registrar and enrollee. Phase two uses mutual authentication based on the enrollee's device password.

Explain in-band and out-of-band WPS registration, including Diffie-Hellman key exchange, public keys, and USB or certificate methods for secure key establishment.

Explore best practices for Wi-Fi Protected Setup PINs, including using eight or more randomized digits, changing the PIN, and when to use a PIN if push-button setup is unavailable.

Analyze initial wlan setup options for small offices, including standalone registrar access points, legacy gear needing external registration, and capable access points with external registrars issuing credentials.

Change all default settings on your access point, including the login and SSID; enable WPA personal, MAC filtering, and cloaking for security in depth.

Learn the history of 802.11 roaming, including association, same-ssid handoffs, and how four-way and radius server-based 802.1X authentications create delays impacting voice over IP during hard handoffs.

Clients decide when to roam between overlapping access points with the same SSID based on roaming thresholds and signal strength, while centralized management enables seamless roaming by sharing authentication state.

Explore how vendor-neutral AP-to-AP handoff works with centralized management—reassociation to a target access point, buffering data, and coordination via a distribution system or wireless LAN controller, following IAPP standards.

Describe how robust security networks use associations and authentication with a central server, complete the four-way handshake, and preserve pairwise transient keys during roaming via preregistration.

Learn how robust security network associations enable fast roaming across multiple access points, reducing four-way handshake delays, with centralized management and WDS-enabled roaming.

Explore how roaming between access points uses a pairwise master key security association (pmksa) and pre authentication to enable seamless handoffs, supported by the four-way handshake and pmk id lists.

Learn how PMK caching speeds roaming by caching PMKs on the original access point, the target, and the client, reducing repeated four-way handshakes and latency.

Pre authentication speeds roaming by establishing a new PMKSA with a target access point; authentication is forwarded to the radius server, using PMK1 and PMK2 to skip the four-way handshake.

Explore opportunistic key caching (OKC) and fast secure roaming (FSR) through centralized PMK caching on a wireless LAN controller. Learn how this reduces per-target handshakes and radius-server load during roaming.

Explore the fast transition initial mobility domain association, where a mobility domain links to the client through authentication and association frames with mobility domain information elements.

Explain how over the air fast BSS transition shares authentication and association information between original and target access points to enable seamless roaming.

Secure roaming by using radio resource measurements (RM) and neighbor requests and reports to select the best access point, guided by a wireless LAN controller.

Explore layer three roaming, where ip addresses change yet traffic remains mapped to the original wireless lan controller through capwap tunnel, intra controller roaming, and mobility message exchange.

Understand mobile IP in cellular networks, where the home agent assigns your IP and foreign agents tunnel traffic during roaming. Explore pre-created tunnels and handoffs between agents.

Trace the history of 802.11 roaming, explore robust security and smart associations, and compare legacy to modern roaming with OKC, FSR, fast transitions, 11k, voice over wifi, and troubleshooting.

Identify common denial of service, eavesdropping, and man-in-the-middle attacks shared by wired and wireless networks, and explore the wireless-specific threats you must be prepared for.

Analyze rogue devices and rogue access points, and explore detection with war walking and wireless LAN controllers. Examine ad hoc networks and printers' risks, and block rogue ports on switches.

Explore rogue prevention by detecting unauthorized access points with a wireless LAN controller, sending deauth messages to disconnect rogue clients, and optionally shutting switch ports, underpinned by wireless intrusion prevention.

Explore eavesdropping on wireless networks and why encryption protects traffic, with passive scanning, MAC and vendor details, beacons, SSID, roaming data, and tools like Wireshark and NetStumbler.

Learn how layer two denial-of-service attacks disrupt wireless connections by spoofing a client's MAC address and disassociation or deauthentication frames, causing the access point to sever authentication and force re-connection.

Explore 802.11w's management frame protection, a method to verify that deauthentication and disassociation messages originate from the legitimate access point and not from spoofed frames.

Explore wireless hijacking and the evil twin attack, where a hacker creates a closer rogue access point to intercept traffic, forge ssl certificates, and steal data via a man-in-the-middle attack.

Secure management interfaces on wireless access points by disabling defaults, changing admin credentials, applying patches, and monitoring CVEs to prevent unauthorized access and data theft.

Evaluate public access wlan hotspots, identify the risk of evil twins, and note that many networks lack encryption, making user activity susceptible to interception.

Use Cain and Abel to scan for rogue wireless devices, map nearby ssids and channels, and walk the building to locate and mitigate interference and unapproved access points.

Assess wireless security risks, including rogue access, eavesdropping, authentication challenges, DoS, spoofing, hijacking, encryption cracking, peer-to-peer and management interface exploits, social engineering, and public hotspots.

Auditing verifies compliance with security expectations, helps meet laws and regulations by jurisdiction, and assesses performance for proactive security to prevent incidents, using external auditing services and isolated equipment.

Balance security and performance in wireless LAN audits to avoid slowing or blocking access. Regularly audit changes to wireless LANs, with internal audits and external reviews for compliance.

Conduct comprehensive wifi audits by evaluating layer one and layer two, performing penetration testing, auditing wired infrastructure, social engineering, and wireless intrusion prevention systems, all supported by verifiable documentation.

Perform a layer 2 audit to identify rogue clients and access points. Use intrusion prevention tools and war walking to verify mac addresses, device types, authentication, encryption, and channel use.

Conduct a white-hat penetration test to assess your network, test rogue access points and traffic decryption, and consider denial of service risks, with an approved statement of work and patches.

Audit social engineering readiness through awareness training and assessments. Explore scenarios like shoulder-surfing and attempts to obtain passwords or wireless pre-shared keys to strengthen safeguards.

Documentation supports recommendations on encryption, authentication, and role-based access control, and emphasizes monitoring with a central logging server, policy review, training, and physical security.

Identify auditing tools and the needed equipment, from wireless cards in promiscuous mode to Linux-based tools, spectrum analyzers, and open source or commercial options, with thorough documentation.

Explore how to conduct a wireless LAN security audit, assess auditing tools, and apply Linux tools for budget-friendly documentation and auditing processes.