[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.2.b
AP Cybersecurity · Securing Networks
Configuring Wireless Network Security
Encryption and authentication do the work. Hiding the name only buys time.
key ideaEncryption and authentication do the work. Hiding the name and filtering MACs only buy time.
The syntax
Wireless configuration mixes two very different kinds of setting: those that make interception useless, and those that make the network harder to find. Only the first kind is a security boundary, and the two are constantly confused.
access point configurationthe four CED settings, in one place
wireless-ap ap-nw-2
ssid "CorpNet"
broadcast-ssid disabled # beacon off: harder to find, not hidden
security wpa3-enterprise # WEP / WPS / original WPA are broken
auth-method eap-tls # certificate-based; no shared password
tx-power medium # coverage shaped to the floor, not the street
antenna directional 210 # aimed inward, away from the car park
mac-filter enabled # last line; MACs can be spoofed
broadcast-ssid disabledstops beacon frames advertising the network — the SSID is still in every framesecurity wpa3-enterprisethe load-bearing line — WEP, WPS and original WPA have known vulnerabilitiesauth-method eap-tlsEAP authentication, so joining requires proving identitytx-power / antennashapes coverage so signal does not extend beyond the space the AP is meant to covermac-filter enableduseful friction; MAC addresses can be spoofed once observed
| Setting | What it does | How strong | Why |
|---|
| strong encryption (WPA2/WPA3) | frames are unreadable if intercepted | strong | the only setting that protects captured traffic |
| user authentication (EAP) | only known identities may join | strong | stops adversaries joining to attack from within |
| signal shaping | coverage confined to the intended space | moderate | reduces who can even hear the network |
| disable beacon broadcasting | the network is not advertised | weak alone | harder to find; the SSID still appears in traffic |
| MAC filtering | unlisted devices are refused | weak alone | MAC addresses are observable and spoofable |
Rows 4 and 5 are worth having and worth understanding. They raise the cost of the first step and defeat nobody determined — which is fine, provided rows 1 and 2 are in place.
Doing it step by step
The first two rows are the security boundary; the last two are friction. An adversary who cannot read the frames does not much care that the network was easy to find.1
Set the encryption protocol first
WPA2 or WPA3. WEP, WPS and the original WPA have known vulnerabilities and should not be used.
out frames that are unreadable when intercepted
2
Require authentication to join
An EAP method so users and devices prove identity. A shared passphrase is one leak away from being everybody's.
out a network only known identities can join
3
Shape the coverage
Adjust broadcast direction and signal strength so the signal does not extend beyond the physical space the AP is meant to cover.
out a smaller audience
4
Add the friction settings
Disable beacon frame broadcasting and enable MAC filtering. Both make discovery and joining harder without being relied upon.
out a slower adversary
5
Verify from outside the building
Walk the perimeter with a scanner. The configuration is a claim; the walk is the evidence.
out a measured coverage boundary
verification, from the car parkwhat an adversary hears from outside
$ wifi-scan --passive --duration 60
SSID BSSID SIGNAL SECURITY
(hidden) a4:2b:8c:11:04:9f -71dBm WPA3-ENT <- ours, weak but audible
GuestCafe c8:3a:35:77:12:e0 -48dBm WPA2-PSK
(hidden) a4:2b:8c:11:04:a1 -83dBm WPA3-ENT <- ours, barely reaches
(hidden)a disabled beacon shows as hidden — visible as a network that exists-71dBmaudible from the car park — signal shaping is not finishedWPA3-ENTthe important column — audible but not readable-83dBmnear the noise floor — this AP is shaped correctly
Worked analysis
EX 1
Choose the encryption
An access point offers WEP, WPA, WPA2 and WPA3. Which do you select, and what do you tell the person who wants WEP for an old device?
1
Rule out the broken options
WEP, WPS and the original WPA have known vulnerabilities.
2
Choose
WPA3 where supported, otherwise WPA2.
3
Address the old device
Selecting WEP for the network would weaken it for everyone.
4
Give the alternative
Put the legacy device on a separate, isolated network that reaches only what it must.
5
State the principle
One device’s limitation must not set the security of the whole network.
EX 2
How much does hiding the SSID buy?
An administrator disables beacon broadcasting and says the network is now invisible. Assess.
1
State what it does
It stops the AP advertising the network and its basic properties.
2
State what it does not do
The SSID still appears in client traffic, so a passive listener recovers it.
3
Note the scanner result
The network shows as (hidden) — its existence is not concealed.
4
Give the correct framing
Useful friction, not a boundary.
5
Name what actually protects it
Encryption and authentication. If those are right, discovery matters far less.
EX 3
Shaping the signal
A scan from the car park shows the corporate AP at -71dBm. What is wrong and what do you change?
1
Interpret the reading
Comfortably audible from outside — the signal extends beyond the intended space.
2
Name the exposure
Anyone outside can attempt to join or capture frames for offline work.
3
Adjust the power
Reduce transmit power until interior coverage is adequate and exterior is not.
4
Adjust the direction
Reposition or use directional antennas aimed inward.
5
Re-measure
Walk the perimeter again. The target is a measurement, not a setting.
Verify the result
four checks
- Confirm the encryption in use is WPA2 or WPA3 — read it from an external scan, not from the admin page.
- Confirm joining requires authentication by attempting to join with an unknown device.
- Measure signal at the perimeter, not at the desk.
- Treat hidden SSID and MAC filtering as friction; never count them as the control.
Check yourself
Which wireless encryption protocols should not be used, and why?
Show answer
WEP, WPS and the original WPA — they have known vulnerabilities. Use WPA2 or WPA3 so intercepted frames are not readable.
What does disabling beacon frame broadcasting achieve?
Show answer
It makes it harder for adversaries to find the wireless network and learn its basic properties. It does not hide the network from a determined listener.
Why control broadcast direction and signal strength?
Show answer
So the signal does not extend beyond the physical space the access point is meant to cover — which shrinks the set of people who can attack it at all.
What are the limits of MAC filtering?
Show answer
It prevents unauthorized devices joining, but MAC addresses are observable and can be spoofed. Pair it with authentication rather than relying on it.