WEBVTT 1 00:00.000 --> 00:05.600 Most of us who have set up wireless networks even at home are probably familiar 2 00:05.600 --> 00:05.920 with the 3 00:05.920 --> 00:10.160 concept of WPA, which stands for Wi-Fi protected access. 4 00:10.160 --> 00:14.920 WPA at the time of this video has three different versions, and the original W 5 00:14.920 --> 00:15.760 PA we definitely 6 00:15.760 --> 00:17.400 don't want to use anymore. 7 00:17.400 --> 00:20.800 These days it's between WPA2 and WPA3. 8 00:20.800 --> 00:26.260 Now in modern enterprise networks, we should absolutely be either deploying or 9 00:26.260 --> 00:27.040 migrating 10 00:27.040 --> 00:32.470 towards WPA3, although the reality is that until we migrate all of our hosts WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:27.040 --> 00:32.470 towards WPA3, although the reality is that until we migrate all of our hosts 11 00:32.470 --> 00:33.720 off of WPA2, 12 00:33.720 --> 00:40.270 there's going to be this intermediary period where we have to either run both 13 00:40.270 --> 00:41.240 or WPA3 and 14 00:41.240 --> 00:44.400 backwards compatibility mode and so on and so forth. 15 00:44.400 --> 00:48.420 But just leaving the version conversation behind, either way, when we're 16 00:48.420 --> 00:49.840 looking at WPA, we 17 00:49.840 --> 00:52.960 have two different versions that we should be aware of. 18 00:52.960 --> 00:58.750 We have a personal version which is intended to be used for those small office, 19 00:58.750 --> 00:59.760 home office 20 00:59.760 --> 01:03.710 type deployments, basically a scenario where we don't have a robust WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 00:59.760 --> 01:03.710 type deployments, basically a scenario where we don't have a robust 21 01:03.710 --> 01:05.040 infrastructure that 22 01:05.040 --> 01:09.100 can, you know, like radius and tack act servers and these kinds of things, 23 01:09.100 --> 01:09.840 which can improve 24 01:09.840 --> 01:16.120 our security but requires not only infrastructure but also expertise around it. 25 01:16.120 --> 01:22.010 And then we have enterprise, which as we might imagine is going to have all of 26 01:22.010 --> 01:22.600 those 27 01:22.600 --> 01:23.840 different features. 28 01:23.840 --> 01:29.720 So these are intended as the name implies for enterprise types of networks. 29 01:29.720 --> 01:32.470 So let's go ahead and dive into this and understand what the difference is and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 29 01:29.720 --> 01:32.470 So let's go ahead and dive into this and understand what the difference is and 30 01:32.470 --> 01:32.760 when 31 01:32.760 --> 01:34.600 we would want to use one over the other. 32 01:34.600 --> 01:38.360 And we kind of already implied, hey, if we have a small office, home office, 33 01:38.360 --> 01:38.920 just my 34 01:38.920 --> 01:43.310 residential Wi-Fi, what I use here in the house, I'm probably going to use WPA 35 01:43.310 --> 01:44.120 personal, 36 01:44.120 --> 01:46.840 whereas all of our enterprises should be using enterprise. 37 01:46.840 --> 01:53.070 We should not be deploying personal into our companies and corporate networks, 38 01:53.070 --> 01:53.800 but I will 39 01:53.800 --> 01:57.800 say that I have certainly seen it as I imagine a lot of us have. 40 01:57.800 --> 02:01.200 So either way, when we're talking about personal, we are talking about the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 40 01:57.800 --> 02:01.200 So either way, when we're talking about personal, we are talking about the 41 02:01.200 --> 02:03.880 concept of a pre-shared 42 02:03.880 --> 02:10.440 key, otherwise known as a PSK. 43 02:10.440 --> 02:16.480 The pre-shared key is somewhat notorious in all of our WPA configurations. 44 02:16.480 --> 02:22.100 It is both very simple, very, very simple to deploy, a whole lot easier than 45 02:22.100 --> 02:22.880 anything 46 02:22.880 --> 02:25.600 else that we might consider for wireless security. 47 02:25.600 --> 02:30.680 However, it also is going to come with scaling challenges. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 02:25.600 --> 02:30.680 However, it also is going to come with scaling challenges. 48 02:30.680 --> 02:33.560 Oops, like that. 49 02:33.560 --> 02:35.320 So we don't scale very well. 50 02:35.320 --> 02:40.320 However, it is nice and simple, which is why it works great at home. 51 02:40.320 --> 02:45.760 The idea here is we basically have a single shared, right there in the word, a 52 02:45.760 --> 02:46.280 single 53 02:46.280 --> 02:48.320 shared password. 54 02:48.320 --> 02:53.670 So if I show up at a cafe and they have a sign up that says, "Hey, we have free 55 02:53.670 --> 02:54.200 Wi-Fi 56 02:54.200 --> 02:58.840 and here's the password, this is the pre-shared key." 57 02:58.840 --> 03:04.640 So now I have the pre-shared key and therefore I can use it both for two WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 57 02:58.840 --> 03:04.640 So now I have the pre-shared key and therefore I can use it both for two 58 03:04.640 --> 03:06.160 different reasons 59 03:06.160 --> 03:07.160 here. 60 03:07.160 --> 03:08.320 And this is kind of interesting. 61 03:08.320 --> 03:12.560 I can use it for authentication and I can use it for encryption. 62 03:12.560 --> 03:15.480 Now, what do we mean by this? 63 03:15.480 --> 03:17.680 Well, remember what we just said in the previous video. 64 03:17.680 --> 03:21.350 Anytime we're talking about wireless security, we need to think about it from 65 03:21.350 --> 03:22.320 an authentication 66 03:22.320 --> 03:26.280 perspective and we need to think about it from an encryption perspective. 67 03:26.280 --> 03:33.100 A pre-shared key combines both of these concepts and puts it all on this one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 03:26.280 --> 03:33.100 A pre-shared key combines both of these concepts and puts it all on this one 68 03:33.100 --> 03:33.840 key. 69 03:33.840 --> 03:38.090 What I mean by that is remember with authentication, it's basically proving who 70 03:38.090 --> 03:38.280 I use. 71 03:38.280 --> 03:43.780 I say I am, but it's proving that I deserve access, that I belong on the 72 03:43.780 --> 03:44.840 network. 73 03:44.840 --> 03:47.160 Well, how do I prove I belong? 74 03:47.160 --> 03:54.280 Well, I prove it simply by saying that I have the pre-shared key. 75 03:54.280 --> 03:58.640 Now, yeah, if I go to a cafe, we're all handing out the pre-shared key. 76 03:58.640 --> 04:03.050 But if I think about my home Wi-Fi, for example, I have a pre-shared key WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 76 03:58.640 --> 04:03.050 But if I think about my home Wi-Fi, for example, I have a pre-shared key 77 04:03.050 --> 04:04.160 configured and I don't 78 04:04.160 --> 04:06.720 just advertise it to everybody. 79 04:06.720 --> 04:11.320 My neighbors couldn't use my Wi-Fi because they don't know what my PSK is. 80 04:11.320 --> 04:16.420 However, well, as we'll talk about here in a moment, there are challenges still 81 04:16.420 --> 04:17.840 with PSKs 82 04:17.840 --> 04:21.400 and the fact that maybe people do have my pre-shared key. 83 04:21.400 --> 04:24.760 And at that point, what does that mean for my security? 84 04:24.760 --> 04:26.880 The other thing is encryption. 85 04:26.880 --> 04:33.080 So the encryption is going to leverage the PSK to form my encryption keys. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 04:26.880 --> 04:33.080 So the encryption is going to leverage the PSK to form my encryption keys. 86 04:33.080 --> 04:37.880 Now, to be clear, the PSK is not an encryption key. 87 04:37.880 --> 04:43.100 It just allows me to authenticate and then get the encryption keys by using the 88 04:43.100 --> 04:44.000 pre-shared 89 04:44.000 --> 04:45.640 key itself. 90 04:45.640 --> 04:48.600 This also creates an interesting situation. 91 04:48.600 --> 04:52.960 So let's go through the problem with this. 92 04:52.960 --> 04:54.520 We see the benefit. 93 04:54.520 --> 04:56.080 The benefit is this is very simple. 94 04:56.080 --> 04:59.800 If I have a guest show up at my home, I can give them the PSK. 95 04:59.800 --> 05:04.920 They have the PSK, they can get on to my Wi-Fi, they prove they belong, they WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 95 04:59.800 --> 05:04.920 They have the PSK, they can get on to my Wi-Fi, they prove they belong, they 96 05:04.920 --> 05:06.680 use it for encryption, 97 05:06.680 --> 05:09.480 life should be good from that perspective. 98 05:09.480 --> 05:17.100 But there are some major downsides to my pre-shared key from a scaling 99 05:17.100 --> 05:17.800 perspective. 100 05:17.800 --> 05:22.160 And when I think about scaling, hey, I'm thinking about enterprise networks. 101 05:22.160 --> 05:26.650 Remember, scaling is very, very important when we're talking about enterprise 102 05:26.650 --> 05:27.480 networks. 103 05:27.480 --> 05:33.000 So we have some scaling concerns here with pre-shared keys. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 05:27.480 --> 05:33.000 So we have some scaling concerns here with pre-shared keys. 104 05:33.000 --> 05:37.770 First and foremost, keep in mind that a pre-shared key is sort of everything 105 05:37.770 --> 05:38.760 all in one. 106 05:38.760 --> 05:45.030 It's my authentication, it's my encryption, which means that if I have the pre- 107 05:45.030 --> 05:45.560 shared 108 05:45.560 --> 05:52.320 key and I'm talking to an access point, but you also have the same pre-shared 109 05:52.320 --> 05:52.480 key and 110 05:52.480 --> 05:57.720 you're using this to encrypt your traffic, I can listen into this and I can 111 05:57.720 --> 05:58.600 decrypt your 112 05:58.600 --> 05:59.680 traffic. 113 05:59.680 --> 06:01.200 We both have the same key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 113 05:59.680 --> 06:01.200 We both have the same key. 114 06:01.200 --> 06:06.640 We are both capable of decrypting one another's traffic because of this pre- 115 06:06.640 --> 06:08.320 shared key concept. 116 06:08.320 --> 06:11.000 Now this does change with WPA3. 117 06:11.000 --> 06:14.320 It's one of the reasons why we want to go over to WPA3. 118 06:14.320 --> 06:19.720 There are additional protections in place, but with WPA2, this is absolutely a 119 06:19.720 --> 06:20.360 concern 120 06:20.360 --> 06:25.730 that I can simply listen in to your communications and I can decrypt them using 121 06:25.730 --> 06:27.200 the same pre-shared 122 06:27.200 --> 06:30.280 key that we both have. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 122 06:27.200 --> 06:30.280 key that we both have. 123 06:30.280 --> 06:35.560 The other problem is managing access. 124 06:35.560 --> 06:37.560 This is a major scaling problem. 125 06:37.560 --> 06:40.120 You say, "Well, wait a second, this is easy to manage access. 126 06:40.120 --> 06:43.320 I just give out the pre-shared key to anybody who wants it." 127 06:43.320 --> 06:44.840 Sure, that works well. 128 06:44.840 --> 06:49.680 But how do I revoke access to my wireless network? 129 06:49.680 --> 06:54.670 I've just given out the pre-shared key and I've got in my house, for example, 130 06:54.670 --> 06:55.360 let's say 131 06:55.360 --> 06:59.600 I've got like 30 wireless devices and they all have the same pre-shared key. 132 06:59.600 --> 07:02.360 Again, this works great in my house. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 132 06:59.600 --> 07:02.360 Again, this works great in my house. 133 07:02.360 --> 07:07.350 But now let's say I give my pre-shared key to my neighbor so that they can use 134 07:07.350 --> 07:08.080 the Wi-Fi 135 07:08.080 --> 07:10.080 while they're over at my house. 136 07:10.080 --> 07:13.860 Well now my neighbor is over in their house and they still have my pre-shared 137 07:13.860 --> 07:14.600 key, meaning 138 07:14.600 --> 07:19.360 they can continue to access my Wi-Fi from their own home in all likelihood. 139 07:19.360 --> 07:21.640 So how do I revoke that access? 140 07:21.640 --> 07:25.830 The only thing I can do is change it to go from pre-shared key one to pre- 141 07:25.830 --> 07:26.600 shared key 142 07:26.600 --> 07:30.240 two and yet think about all of the implications of that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 142 07:26.600 --> 07:30.240 two and yet think about all of the implications of that. 143 07:30.240 --> 07:35.400 I have to go to all of these other 30 devices and change the pre-shared key to 144 07:35.400 --> 07:36.000 something 145 07:36.000 --> 07:40.200 new, just to prevent this one user from accessing my network. 146 07:40.200 --> 07:43.240 Well, this is going to apply to our enterprise networks as well. 147 07:43.240 --> 07:47.270 Again, think about it from a scaling perspective in terms of whether or not I'd 148 07:47.270 --> 07:48.080 want to deploy 149 07:48.080 --> 07:50.800 this into a corporate network. 150 07:50.800 --> 07:54.490 This is one of the major reasons why we wouldn't want to do that because 151 07:54.490 --> 07:55.600 essentially in the 152 07:55.600 --> 08:02.140 event that this gets compromised and a compromising event could be as simple as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 152 07:55.600 --> 08:02.140 event that this gets compromised and a compromising event could be as simple as 153 08:02.140 --> 08:03.600 one of my account 154 08:03.600 --> 08:08.050 managers quits and leaves and they know the pre-shared key because they've had 155 08:08.050 --> 08:08.520 to put 156 08:08.520 --> 08:10.920 it onto their laptop so many times. 157 08:10.920 --> 08:16.080 Well that employee who just left knows our security key for our wireless and so 158 08:16.080 --> 08:16.600 I can't 159 08:16.600 --> 08:20.870 revoke them, the revoke their access, I am going to instead have to change the 160 08:20.870 --> 08:21.600 pre-shared 161 08:21.600 --> 08:22.600 key. 162 08:22.600 --> 08:27.700 So this is one of the main ways that it does not scale for enterprise 163 08:27.700 --> 08:28.040 deployments. 164 08:28.040 --> 08:31.710 So at the end of this conversation we see that the pre-shared key is great from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 164 08:28.040 --> 08:31.710 So at the end of this conversation we see that the pre-shared key is great from 165 08:31.710 --> 08:32.400 a personal 166 08:32.400 --> 08:37.490 perspective even though it does still apply some challenges here like I just 167 08:37.490 --> 08:38.760 said, hey 168 08:38.760 --> 08:42.600 anybody I give the pre-shared key to, they've got more or less permanent access 169 08:42.600 --> 08:43.200 to my home 170 08:43.200 --> 08:47.730 network but at least it doesn't require a whole lot of infrastructure and 171 08:47.730 --> 08:48.800 architecture. 172 08:48.800 --> 08:52.640 So let's go and talk about enterprise WPA. 173 08:52.640 --> 08:56.120 This is what we should be deploying into our corporate networks. 174 08:56.120 --> 09:03.890 The WPA enterprises introduces a new concept here of 802.1x using that as well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 174 08:56.120 --> 09:03.890 The WPA enterprises introduces a new concept here of 802.1x using that as well 175 09:03.890 --> 09:04.600 as what 176 09:04.600 --> 09:09.240 we call EAP and we'll talk about EAP here in a moment. 177 09:09.240 --> 09:18.490 But 802.1x and EAP specifically these are going to split the concept here of 178 09:18.490 --> 09:20.200 our encryption 179 09:20.200 --> 09:23.560 and our authentication. 180 09:23.560 --> 09:27.780 Meaning that I'm not going to be able to use the same mechanism to both authent 181 09:27.780 --> 09:28.520 icate and 182 09:28.520 --> 09:31.080 encrypt, these are going to be different. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 182 09:28.520 --> 09:31.080 encrypt, these are going to be different. 183 09:31.080 --> 09:34.120 There's this wall that's built between the two. 184 09:34.120 --> 09:41.050 So the idea here is that when I first authenticate to the network, to the 185 09:41.050 --> 09:42.640 access point, I'm going 186 09:42.640 --> 09:49.760 to try to connect to this and I'm going to use an 802.1x mechanism for doing so 187 09:49.760 --> 09:49.800 . 188 09:49.800 --> 09:54.920 We have a lot of different options and those options are provided by EAP. 189 09:54.920 --> 09:59.230 Meaning I can provide a username or an password or I can do a certificate or 190 09:59.230 --> 10:00.200 any of the other WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 190 09:59.230 --> 10:00.200 any of the other 191 10:00.200 --> 10:02.160 options that we talked about. 192 10:02.160 --> 10:06.310 So I've got a lot of different options for authenticating but none of this 193 10:06.310 --> 10:07.160 provides an 194 10:07.160 --> 10:09.000 encryption key. 195 10:09.000 --> 10:14.150 Once I have authenticated, then I go into an encryption mode where I say, "Okay 196 10:14.150 --> 10:14.640 , now 197 10:14.640 --> 10:18.840 it's time for us to create encryption keys." 198 10:18.840 --> 10:23.710 And we can perform a secure process known as a Diffie-Hellman key exchange here 199 10:23.710 --> 10:24.080 and this 200 10:24.080 --> 10:31.230 key exchange is going to give us a set of keys that we can use to encrypt our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 200 10:24.080 --> 10:31.230 key exchange is going to give us a set of keys that we can use to encrypt our 201 10:31.230 --> 10:32.120 traffic. 202 10:32.120 --> 10:39.720 And importantly, this is going to be different on a per station basis. 203 10:39.720 --> 10:42.800 Meaning that the encryption keys that I use will be different than the 204 10:42.800 --> 10:43.640 encryption keys 205 10:43.640 --> 10:48.860 that somebody else is using even though we're both connected to the same access 206 10:48.860 --> 10:49.560 point. 207 10:49.560 --> 10:52.840 So that's awesome but here's the downside. 208 10:52.840 --> 10:59.220 802.1x and EAP, this is going to require a radius server or maybe a takx plus 209 10:59.220 --> 11:00.520 server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 209 10:59.220 --> 11:00.520 server. 210 11:00.520 --> 11:03.360 It's going to require some advanced configuration. 211 11:03.360 --> 11:05.680 I might have to use certificates. 212 11:05.680 --> 11:10.000 I might have to set up users and user accounts. 213 11:10.000 --> 11:14.160 But if we think about it from that scaling perspective, well now I can go in 214 11:14.160 --> 11:15.040 here because 215 11:15.040 --> 11:20.760 I have a directory service and I can revoke access. 216 11:20.760 --> 11:25.630 This issue here is now gone because I can make it so whatever we're using over 217 11:25.630 --> 11:26.280 here from 218 11:26.280 --> 11:31.250 a username, password, certificate, perspective, I can go into my infrastructure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 218 11:26.280 --> 11:31.250 a username, password, certificate, perspective, I can go into my infrastructure 219 11:31.250 --> 11:32.120 and say, hey, 220 11:32.120 --> 11:36.840 that account manager who just left no longer allow them to access the network. 221 11:36.840 --> 11:40.040 So even though they maybe took their laptop home, whether they were supposed to 222 11:40.040 --> 11:40.440 or not, 223 11:40.440 --> 11:43.770 I don't know, but even though they took it home, if they were to drive back to 224 11:43.770 --> 11:44.400 the parking 225 11:44.400 --> 11:48.210 lot and try to connect to the wireless, whenever they tried to authenticate, 226 11:48.210 --> 11:49.080 the access point 227 11:49.080 --> 11:53.690 is going to reject that attempt because they have been revoked from or they've 228 11:53.690 --> 11:54.400 been removed 229 11:54.400 --> 11:58.880 from our infrastructure, from our directory service. 230 11:58.880 --> 12:03.720 And so the good and bad of this is, hey, great, we've got the scaling. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 230 11:58.880 --> 12:03.720 And so the good and bad of this is, hey, great, we've got the scaling. 231 12:03.720 --> 12:07.410 Unfortunately, it requires a lot of infrastructure and expertise on how to 232 12:07.410 --> 12:09.040 manage that infrastructure, 233 12:09.040 --> 12:11.760 which is why it's an enterprise solution. 234 12:11.760 --> 12:15.770 But we do see that it tackles some of the concerns and the problems with WPA 235 12:15.770 --> 12:17.000 personal, especially 236 12:17.000 --> 12:20.240 as it relates to trying to deploy that into a corporate network.