Course 10 - Network Security Fundamentals | Episode 2: Securing Wireless and Mobile Networks: Standards, Threats, and Best Practices

In this lesson, you’ll learn about:Wireless networking standards and operating modesWi-Fi security best practices and hardening techniquesCellular/mobile device threats and defensive controlsCommon wireless attacks and mitigation strategiesI. Wireless Network Standards and Basics Wi-Fi (802.11 Standard) Overview Wi-Fi is based on the IEEE 802.11 family of standards and uses radio waves to transmit data. The most common frequencies are 2.4 GHz and 5 GHz, regulated by authorities such as the FCC. Evolution of Key 802.11 Amendments802.11a: 5 GHz802.11b: 2.4 GHz802.11g: 2.4 GHz (faster successor to 11b)802.11n: Operates on both 2.4 GHz and 5 GHz802.11ac: Supports speeds up to ~1 Gbps802.11ax (Wi-Fi 6): Expected speeds up to ~10 GbpsNetwork Operating ModesInfrastructure Mode: Central router/AP manages communication (default in homes & businesses).Ad-Hoc Mode: Peer-to-peer direct communication without an access point.The network name broadcast by the access point is the SSID (Service Set Identifier). II. Wi-Fi Security and Hardening Practices Legacy Methods to AvoidWEP: Extremely insecure; crackable in under 5 minutes (e.g., via Aircrack-ng).Original WPA: Outdated and vulnerable.Current StandardWPA2-AES: Modern, strong encryption; trusted by government agencies and industry.Critical Hardening TechniquesChange all default settings:Default usernames, passwords, and SSIDs often reveal the device manufacturer and potential vulnerabilities.Use non-descriptive SSIDs:Avoid names indicating location, company, or purpose (OPSEC).Enable 802.1X EAP authentication:Provides strong client verification.MAC Filtering:Restricts access to pre-approved hardware devices. (Not perfect, but adds friction.)Network Isolation:Guest Wi-Fi should be separated from internal corporate networks.Firmware Updates:Essential to patch vulnerabilities (e.g., WPA2 KRACK).Consider alternative firmware such as DD-WRT or OpenWRT.Use WIDS/WIPS:Wireless Intrusion Detection/Prevention systems to monitor or block threats.Emanation Security (MSE):Limit broadcast power to prevent signals from leaking outside the intended perimeter.Consider static IP assignments:Makes it harder for attackers to validate successful infiltration.III. Cellular Networks and Mobile Device Security Cellular ThreatsIMSI Catchers (Stingrays):Fake cell towers used for Man-in-the-Middle attacks, capturing voice, SMS, and metadata.Secure Communication PracticesAlways use end-to-end encrypted protocols, such as:Signal Protocol (Signal, WhatsApp) for calls, messages, and videoStandard voice calls and SMS are unencrypted and easily intercepted.Mobile Device Management (MDM) Organizations use MDM to enforce:Screen lock and passcode policiesApp installation restrictionsRemote wipe capabilityAccount lockout rulesCorporate/BYOD separation of dataLocation Security Control GPS and geotagging to prevent exposure of sensitive operations (e.g., military, law enforcement, executive movement). 5G Concerns Ongoing scrutiny exists due to unresolved privacy and security vetting. IV. Wireless Attacks and Mitigation Strategies 1. Rogue Access Points / Evil Twin Attacks Attack: Fake hotspots mimic legitimate networks to steal credentials or intercept traffic.Mitigation:Employee education about correct SSID namesDisable auto-connect to unknown networks2. WPA2 KRACK (Key Reinstallation Attack) Attack: Exploits the 4-way handshake to reinstall encryption keys.Mitigation:Immediate firmware and OS updates across all vendors3. MAC Address Spoofing Attack: Impersonates a trusted device to bypass MAC filtering.Mitigation:Use stronger authentication (e.g., 802.1X)4. Packet Sniffing Attack: Unencrypted data intercepted over the air.Mitigation:Enforce secure, encrypted protocols end-to-end5. Peer-to-Peer Attacks Attack: Malicious activity from devices on the same local wireless network.Mitigation:Client isolationStrong network segmentation6. Social Engineering Attack: Human manipulation—tricking users into revealing credentials or taking unsafe actions.Mitigation:Security awareness training"Trust but Verify" approach to all requests and identitiesYou can listen and download our episodes for free on more than 10 different platforms:https://linktr.ee/cybercode_academy