WEBVTT

1
00:00.000 --> 00:04.000
Alright, for this challenge we're going to go through four quiz questions

2
00:04.000 --> 00:04.680
together.

3
00:04.680 --> 00:05.920
We'll just ask the question.

4
00:05.920 --> 00:09.320
Feel free to pause the video, make sure you have ample time to answer.

5
00:09.320 --> 00:13.400
And if we don't understand anything, then we've got the source for the video

6
00:13.400 --> 00:13.680
here at

7
00:13.680 --> 00:15.560
the bottom of each quiz question.

8
00:15.560 --> 00:18.980
So question number one, what are the two critical components of configuring

9
00:18.980 --> 00:21.480
wireless security?

10
00:21.480 --> 00:26.110
So this is interesting because when we look at it, RF containment could

11
00:26.110 --> 00:27.400
certainly be an

12
00:27.400 --> 00:30.280
aspect of making sure that we are secure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:27.400 --> 00:30.280
aspect of making sure that we are secure.

13
00:30.280 --> 00:33.760
We want to keep our RF contained as much as possible.

14
00:33.760 --> 00:38.620
But it's not nearly as critical as our access control and our privacy.

15
00:38.620 --> 00:43.390
In order to configure access control, we're going to configure authentication

16
00:43.390 --> 00:43.860
to help

17
00:43.860 --> 00:45.240
us with our data privacy.

18
00:45.240 --> 00:48.720
We're going to want to configure encryption.

19
00:48.720 --> 00:52.820
And so these are the two big factors when it comes to our wireless

20
00:52.820 --> 00:54.280
communications.

21
00:54.280 --> 00:59.130
Anytime we're talking about WPA personal versus WPA enterprise, especially for

22
00:59.130 --> 00:59.760
example,

23
00:59.760 --> 01:07.090
the PSK concept versus 802.1x, these are really focused on making sure we have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.760 --> 01:07.090
the PSK concept versus 802.1x, these are really focused on making sure we have

24
01:07.090 --> 01:08.560
authentication

25
01:08.560 --> 01:10.320
and encryption configured.

26
01:10.320 --> 01:15.440
As we discussed, they scale at different levels and they have different amounts

27
01:15.440 --> 01:16.520
of granularity

28
01:16.520 --> 01:21.040
when it comes to configuring each one of these concepts.

29
01:21.040 --> 01:24.240
Question two, what does WPA enterprise use in order to better use?

30
01:24.240 --> 01:29.360
Better scale wireless authentication than WPA personal.

31
01:29.360 --> 01:32.360
So we're comparing WPA enterprise to WPA personal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:29.360 --> 01:32.360
So we're comparing WPA enterprise to WPA personal.

32
01:32.360 --> 01:36.930
WPA personal is going to use the pre shared key concept where WPA enterprise is

33
01:36.930 --> 01:37.360
going

34
01:37.360 --> 01:44.290
to use a much more complex or at least sophisticated architecture in 802.1x as

35
01:44.290 --> 01:45.440
well as EAP.

36
01:45.440 --> 01:51.490
802.1x is going to define the architecture for us, giving us the concept of a

37
01:51.490 --> 01:52.440
supplicant

38
01:52.440 --> 01:57.480
and authenticator and then the authentication server on the back end.

39
01:57.480 --> 02:02.170
Meanwhile, EAP is going to define for us what exactly we're providing here in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:57.480 --> 02:02.170
Meanwhile, EAP is going to define for us what exactly we're providing here in

40
02:02.170 --> 02:03.120
order to authenticate

41
02:03.120 --> 02:04.360
ourselves.

42
02:04.360 --> 02:10.010
So this is the enterprise architecture, whereas personal is going to combine

43
02:10.010 --> 02:11.280
authentication

44
02:11.280 --> 02:14.440
and encryption into the pre shared key, meaning we're going to use the pre

45
02:14.440 --> 02:15.000
shared key to

46
02:15.000 --> 02:17.560
form our encryption keys.

47
02:17.560 --> 02:22.080
And just the fact that I have the PSK means that I belong on the network.

48
02:22.080 --> 02:26.430
And as we know, as we discussed, rather, using that for authentication and

49
02:26.430 --> 02:27.960
using it for encryption,

50
02:27.960 --> 02:32.190
it's really got a lot of flaws, which is one reason why we want to migrate to W
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:27.960 --> 02:32.190
it's really got a lot of flaws, which is one reason why we want to migrate to W

51
02:32.190 --> 02:32.600
PA three

52
02:32.600 --> 02:36.360
if we're going to rely on a pre shared key concept.

53
02:36.360 --> 02:40.300
So with all that in mind, as we explore these answer choices, when we're

54
02:40.300 --> 02:41.920
comparing WPA enterprise

55
02:41.920 --> 02:47.360
to WPA personal, it doesn't use better encryption, but it does use a radius

56
02:47.360 --> 02:48.240
server.

57
02:48.240 --> 02:52.280
It doesn't use a pre shared key that is what WPA personal does.

58
02:52.280 --> 02:56.080
And using a web portal for access is something that we can configure with web

59
02:56.080 --> 02:56.840
auth, but it

60
02:56.840 --> 03:02.000
isn't actually directly tied to WPA enterprise or WPA personal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:56.840 --> 03:02.000
isn't actually directly tied to WPA enterprise or WPA personal.

61
03:02.000 --> 03:06.020
And so using a radius server or possibly attack X server here is part of the

62
03:06.020 --> 03:07.400
802.1x

63
03:07.400 --> 03:08.400
architecture.

64
03:08.400 --> 03:12.720
That is what sets enterprise apart from personal.

65
03:12.720 --> 03:17.160
Well question three, and we're going to ask about that 802.1x architecture.

66
03:17.160 --> 03:22.760
So which two devices can serve as that authenticator in a wireless network?

67
03:22.760 --> 03:26.720
Well when I draw out that architecture, we said that the station that's going

68
03:26.720 --> 03:27.440
to associate

69
03:27.440 --> 03:29.720
to the network is the supplicant.

70
03:29.720 --> 03:34.040
And then we're going to have the authentication server here on the back end.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:29.720 --> 03:34.040
And then we're going to have the authentication server here on the back end.

71
03:34.040 --> 03:35.680
But what about this thing in the middle?

72
03:35.680 --> 03:39.200
This is what we refer to as the authenticator.

73
03:39.200 --> 03:42.450
And in our case with a wireless network, it could actually be one of two things

74
03:42.450 --> 03:42.680
.

75
03:42.680 --> 03:46.950
It could be an access point or it could actually be that the access point sort

76
03:46.950 --> 03:47.960
of transparently

77
03:47.960 --> 03:51.720
hands that communication off to the wireless LAN controller.

78
03:51.720 --> 03:54.440
So our two choices are right there at the top of the list.

79
03:54.440 --> 03:58.500
An access point or wireless LAN controller keeping in mind that a switch

80
03:58.500 --> 03:59.320
actually can

81
03:59.320 --> 04:05.400
serve as the authenticator, but that wouldn't be part of a wireless network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:59.320 --> 04:05.400
serve as the authenticator, but that wouldn't be part of a wireless network.

82
04:05.400 --> 04:06.400
Alright last question.

83
04:06.400 --> 04:10.920
What are two goals of the WPA four way handshake?

84
04:10.920 --> 04:15.650
As with so many other things that we've talked about, WPA is all about

85
04:15.650 --> 04:17.120
authentication and

86
04:17.120 --> 04:18.440
encryption.

87
04:18.440 --> 04:21.870
And so we're going to authenticate the user and we can do this with either

88
04:21.870 --> 04:22.680
personal via

89
04:22.680 --> 04:23.680
P shared key.

90
04:23.680 --> 04:27.250
Again, just having the pre shared key technically is the authentication

91
04:27.250 --> 04:28.000
mechanism.

92
04:28.000 --> 04:32.120
I prove I belong on the network because I know the secret password.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:28.000 --> 04:32.120
I prove I belong on the network because I know the secret password.

93
04:32.120 --> 04:38.200
And then it's also going to authenticate via enter WPA enterprise and we will

94
04:38.200 --> 04:39.680
use 802.1x

95
04:39.680 --> 04:41.560
and EAP for that.

96
04:41.560 --> 04:44.160
Meanwhile the derivation of the encryption keys.

97
04:44.160 --> 04:47.800
Yeah, we're going to use the pre shared key to help us with that.

98
04:47.800 --> 04:51.750
But either way, we're going to create encryption keys for personal and we're

99
04:51.750 --> 04:52.520
going to do the

100
04:52.520 --> 04:56.520
exact same thing for enterprise just in a different way.

101
04:56.520 --> 04:59.520
So the two goals are the same between the two versions.

102
04:59.520 --> 05:04.950
Just keep in mind that if we're going to use WPA with 802.1x, which is what we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
04:59.520 --> 05:04.950
Just keep in mind that if we're going to use WPA with 802.1x, which is what we

103
05:04.950 --> 05:05.480
should

104
05:05.480 --> 05:09.860
be doing in a enterprise corporate network, that it will take a lot longer for

105
05:09.860 --> 05:10.360
us to get

106
05:10.360 --> 05:14.520
through that process because we also have to do all the 802.1x stuff first.

107
05:14.520 --> 05:17.810
And so once we get through all of that, then we can do the WPA four way

108
05:17.810 --> 05:18.600
handshake.

109
05:18.600 --> 05:23.310
But in either case, WPA enterprise or WPA personal, we are going to expect to

110
05:23.310 --> 05:23.920
see that

111
05:23.920 --> 05:25.440
WPA four way handshake.

112
05:25.440 --> 05:30.130
And it's actually fun to check that out sometime using wireless packet sniffers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:25.440 --> 05:30.130
And it's actually fun to check that out sometime using wireless packet sniffers

113
05:30.130 --> 05:30.760
because we

114
05:30.760 --> 05:34.360
can actually see the messages go back and forth as part of that handshake.

115
05:34.360 --> 05:36.960
I hope this has been informative for you and I'd like to thank you for viewing.