Hello and welcome to this video titled a recap of Wi-Fi security fundamentals.
So before we jump into this course, I just want to do a really quick,
very high level overview or recap of stuff that hopefully you already
have learned from my previous course.
So if you haven't already seen it, I would highly recommend that you pause
this course and go back to my jumping into Wi-Fi security course and watch
that all the way through.
So in that course, you'll learn about things like why Wi-Fi needs security
in the first place, you know, what are the differences between confidentiality,
authentication and data integrity, and what are some of the main differences
between WPA, Wi-Fi protected access, and WPA2.
And then lastly, that course also sort of demonstrates how to create a
wireless LAN with WPA2 authentication on both an access point and a controller.
So if you don't already have some familiarity, some experience with those
basic concepts, I would definitely recommend that you watch that course
first and then proceed into this one.
Okay, so assuming that you have that as a background already, let's just
review real quickly here, sort of the evolution that Wi-Fi protocols went
through. So when Wi-Fi was first developed, okay, first of all, it wasn't
even called Wi-Fi.
That was a term or a marketing term that came much later.
So Wi-Fi was, I'll say wireless networking, wireless LANs, were first
developed by the IEEE 802.11 committee, and it was around 1997 when that
was developed. And so when the 802.11 committee came up with this concept
of wireless LANs, at the very beginning, it had this concept of using
authentication and encryption using WEP, which was called Wired Equivalent
Privacy. You can see here the date it was introduced, a little bit about
the cipher and keys.
And look at that last bullet point there, broken due to IV reuse.
That was called the initialization vector.
Not going to go into any details of that, but it was quickly discovered
after not too many years, maybe just like two or three years after this
was introduced, that with very little effort, people could crack into
WEP, and then they could actually get on the wireless LAN and even worse,
they could see your encrypted data that was going across the wireless
LAN. So the IEEE said, okay, we have to kind of go back to the drawing
board here and come up with something better because this isn't going
to work. And so they said, well, if we're going to go back to the drawing
board, there's a lot of things we could really do here.
We could really work on all the confidentiality aspects of it.
How are we going to do data encryption?
How are we going to implement some new algorithms to do that?
Data integrity? How are we going to make sure that data hasn't been changed
in transit? What are a bunch of authentication mechanisms and a whole
bunch of other stuff?
So they said, let's just think about wireless security as a whole.
And since we've got this opportunity to update things, let's sort of take
our time and update things so that when we're finally done and we have
a new ratified amendment that we can say this is comprehensive.
This not only fixes WEP's problems, but also introduces a whole bunch
of new things that we didn't even have before.
So the committee that they got together to do that was called the 802
.11i committee. So the 802.11i amendment was this comprehensive amendment
to do security. But here's the problem.
Pretty much people knew in advance that this is going to be a multi-year
effort. It was going to take a long time for 802.11i to finally be ratified
for everything to be worked out.
And there was a lot of invention that was going to have to take place
as well. They didn't have all the protocols and all the features and standards
already working when they started with 802.11i.
There were some things, some technologies that already existed that they
thought, hey, we can leverage this.
But then there were other things that said, you know, we need to invent
some stuff from scratch because there's not really any existing solution
right now. But here was the problem is that there was multiple problems.
Number one, before they even started with 802.11i, even though there were
these standards out like 802.11b and 802.11g, not every manufacturer who
implemented this stuff into their access points and clients was fully
interoperable with other manufacturers.
There was a lot of situations in back in the late 1990s, like 1999, 2000,
when you might have a wireless access point that might work with one nitcard
on your laptop, but not work with another nitcard on a different laptop
or your PC might not be able to connect this.
So there was all sorts of interoperability problems where manufacturers
might just be implementing part of the standard and not all of it.
So an organization, so several companies got together and they said, look,
we need to figure out some way of standardizing this of certifying this
so that people can have trust in Wi -Fi whether it be a Windows client
or a Apple client or whatever, that they will work.
They'll be able to connect wirelessly.
We need to be able to have a bunch of a neutral organization that's formed
that can test equipment.
So when equipment comes out, the manufacturers can send us some examples
of their newest access points, their newest nitcards, whatever.
And in the lab environment, we can test all this stuff and then we can
say, yes, this stuff works according to the standard.
It's interoperable.
It works together.
So in 1999, the Wi-Fi Alliance was formed.
Now, the Wi-Fi Alliance actually didn't go by that name back then.
You'll never be tested on this, but originally it was called the Wireless
Ethernet compatibility Alliance, WECA, the Wireless Ethernet compatibility
Alliance. And then a couple of years later in 2002, they changed their
name to the Wi-Fi Alliance.
But that was the goal of the Wi-Fi Alliance was to take different equipment
from different manufacturers and run it through a rigorous testing and
certification process.
So ultimately, if they stuck their Wi -Fi Alliance sticker on there, you
would know that that piece of equipment was trustworthy.
It had gone through tests and it would be interoperable with other equipment
that also had the Wi-Fi Alliance sticker on it.
Okay. So here we are with the Wi-Fi Alliance and now the Wi-Fi Alliance
is aware, as is everybody else, that WEP is broken.
And then they find out that the IEEE is forming this 802.11i committee
to fix this. And they also know, because they've got people actually on
this committee, you know, the Wi-Fi Alliance was composed of people like
Cisco and lots of other vendors as well that contributed to this Wi-Fi
Alliance. They also knew that within this 802.11i committee, there were
already pretty much fully mature that they are going to incorporate into
802.11i. And there were other technologies either hadn't been invented
yet, or were sort of in the process of being invented, but they weren't
really mature yet.
So the Wi-Fi Alliance said, hey, we can't really wait around for 802.11i
to be fully ratified and finished.
That could be many years.
Right now there is a burning critical need for security to be fixed in
wireless devices.
Otherwise, people aren't going to trust wireless.
They're just going to sort of ignore it and toss it to the side.
So they said, well, let's do this.
Let's come up with our own certification based on what we know that's
currently in the draft form of the 802.11i documentation.
And within that draft form, the pieces of it that we know are pretty mature,
that we can safely assume will still be there in that form when the 802
.11i is finally finished years from now.
And so they came up with a certification called Wi-Fi protected access
WPA. And that was the original version of WPA.
So in 2003, they said, well, we know that the 802.11i document is not
standardized yet.
Is including things like T-kip with RC four.
It's now talking about how Wi-Fi we're calling it why that's what the
Wi-Fi Alliance gave it.
They call it the name Wi-Fi.
They're the ones who came up with that.
They say, we know this going to be implemented as either a personal or
an enterprise version.
We're going to do a review of that in just one slide in just a second.
So we will include that in our WPA certification.
There's other stuff in there that's not fully mature yet.
Other stuff in there that's just on paper that no one's even invented
yet. We're not going to include that.
We'll just include the mature technologies.
And so the WPA certification came out.
And one of the goals of WPA was not only to certify that vendors could
now start implementing these mature technologies into their access points
and knit cars and have a much stronger form of security.
But they wanted to make sure that people could do so in a way that did
not require a hardware upgrade.
In other words, if you had an old Wi -Fi knit card or an old Wi-Fi access
point that was only doing web right now, there was a simple software upgrade
you could get to the things in WPA and get your enhanced security.
So that was the main goal of Wi-Fi protected access.
Notice it was a new Wi-Fi.
Now here we are in late 2025.
As you can see here, this has been deprecated by the Wi-Fi alliance.
So really, you should not have even if you have devices that support it,
you should not implement WPA anymore.
It's not it's stronger than WIP, but a lot weaker than much of the modern
stuff that's come out.
So what is the modern stuff that's come out?
Well, in 2004, the 802.11i was finally finished and holy moly, all of
a sudden it's like, oh, wow, there's a bunch of stuff in here that we
didn't have in WPA.
Not only that, the basic security mechanisms of encryption is much stronger.
Oh, look, they're using AES CCMP, which stands for advanced encryption
standard in case you're curious, which is so much better than T-kip with
RC4. So they suddenly realized that while WPA was better than WIP, then
the actual standard of 802.11i now that was finished was much, much stronger,
much, much better than what they had been previously certifying with WPA.
So they had to upgrade their WPA certification and they did that called
WPA2. Now, notice that was in 2004.
WPA2 is pretty much the de facto standard in most devices.
Certainly, if you're talking about like Internet of Things devices like
video cameras, Wi-Fi enabled appliances, Wi-Fi thermostats, almost certainly
they're going to be using WPA2.
Okay. Now, finally, in 2018, they came up with WPA2 much stronger in certain
areas and a lot of new features that WPA2 couldn't even conceive of in
the time. So technically speaking, even though it came out in 2018, which
is still seven, almost eight years ago at this point, if I'm doing my
math right, WPA2 is still the de facto standard.
Ideally, everybody would be using WPA3 in everything that they do with
Wi-Fi. So if you have a choice, if you're in control of the access point
at your home and the Wi-Fi knit cars on your laptop and your tablets,
do WPA3 if they support it.
They probably will.
It's really only going to be those Internet of Things devices that might
have a problem with WPA3.
Okay. So just to finish off our review here, you know, once again, when
WPA came out, the original WPA, they said, well, according to this draft
we have of 802.11i that's not finished yet, that Wi-Fi is going to be
implemented, I should say wireless networking is going to be implemented
in two ways. One of those ways is called personal.
And so we'll call that WPA personal, which is meant for like small offices,
home offices, medium-sized businesses.
But basically, it involves, you know, the access point having a password,
we call that a pre-shared key.
And then on your client, you the wireless LAN, that is personal.
But for larger enterprises or maybe companies are really super security
conscious like the Wi-Fi at the CIA or the NSA or, you know, MI5 in Britain
or something like that, they're going to need much, much stronger security
than personal allows.
And so there's another form of WPA called enterprise that you can use
for that. With WPA enterprise, that involves offloading the authentication
piece of it to an external server called an authentication server and
using a protocol called 802.1x as well as a sub protocol called EAP to
exchange the credentials between the Wi -Fi client, which is called a supplicant
and the authentication server.
And the Wi-Fi access point in the middle is just sort of passing that
stuff back and forth.
So with what with WPA enterprise, you've got a greater variety of much,
much stronger encryption and integrity and authentication algorithms available
to you than you do in personal mode.
Now, this particular course is going to be pretty much almost exclusively
focused on WPA three and in the personal edition.
Okay, so that's what we're going to be focusing on.
So lest you be concerned with, oh man, I feel like I'm missing a whole
bunch of stuff with with WPA enterprise.
Let me just say this.
So WPA enterprise, whether you're talking about WPA two or WPA three enterprise,
the main differences are the types of encryption algorithms that are available
to you. They're much, much stronger.
But honestly, unless you're a software developer or something, you don't
need to know the mechanics of how encryption algorithms actually work.
Very high level, deep level math to get into that.
But like I said, unless you're a physicist or a software developer writing
your own code, you probably don't need to know that.
Now, you should probably know that this encryption is better than this
other one, stronger than this other one.
But how it actually works, you don't need to know that it just works.
So with enterprise version, yes, you get stronger encryption and you can
select those encryption types when you're setting up your wireless LAN
the first time in the first place.
The other thing, obviously, it's different, is it uses 802.1x to talk
between the server and the supplicant, which is your laptop, your tablet.
And that can get very complicated about how 802.1x works, what you need
to put on the client in of 802.1x and everything that happens there, that's
worthy of its own separate course.
Because there's a lot of stuff that gets involved with that.
However, the features that we're going to talk about here in this personal
edition of WPA three are exactly the same.
If you're talking about WPA three with enterprise version.
So once you get past the authentication, all the other stuff we're going
to look at is exactly the same.
The enhanced features, the new things that WPA three can do in personal
mode is exactly the same as WPA three in enterprise mode.
So the only thing you're going to be missing in this course is the actual
mechanics of how the 802.1x stuff happens and the protocols involved in
the 802.1x authentication exchange.
But that's very, very detailed.
And I couldn't create one course that does all of that.
You'll see by the time you're done with this, you'll be all like, whoo,
thank goodness you didn't put that in there because I'm like so overwhelmed.
So just sit back, hang tight, and enjoy this course on WPA three personal.