Given that I’ve posted about the weaknesses of WEP, and how it can be easily cracked in about 15 minutes, I wanted to write about how to secure your corporate wireless environment and keep script kiddies out of your network.

Most companies and wireless AP manufacturers started moving towards WPA-PSK as a default setting for wireless networks. Just recently I’ve learned (and tested) using tools such as coWPAtty to crack WPA-PSK networks that use TKIP and do a brute-force attack on the key. While this does not present such a huge security risk as using WEP does, it still opens the door for sites that use weak WPA keys. Since WPA is stronger, but they key can be the weak point now, is there a way to generate “dynamic” keys? better yet, to generate new keys for every single client station, every time they log on?

The answer is YES! We use WPA/WPA2 Enterprise and RADIUS to create a practically impossible to hack wireless network that offers computer+user access granularity and management, and even easy deployment through Group Policy. Doesn’t that sound cool???

To prepare for the next posts, you’ll need the following:

• A WPA/WPA2 Compatible wireless Access Point. I’m using a Linksys WRT54GS with DD-WRT firmware on it and it works like a charm.
• A Windows Server 2003 with IAS + Certificate Services components installed, and a valid Active Directory domain (you can use FreeRADIUS+LDAP on Linux, but I’m not going to cover that).
• A test laptop or WPA-compatible client that’s a domain member.