You have just set up a wireless network for customers at a coffee shop. Which of the following are good security measures to implement? Each correct…

The strongest safeguard for an openly-accessible WLAN is to require modern link-layer encryption; WPA/WPA2—unlike WEP—implements 802.11i’s TKIP/CCMP protections and is specifically recommended by NIST for all public-access hotspots. In addition, limiting association to a list of approved MAC addresses, while bypassable by spoofing, still provides a second gate that blocks casual or automated drive-by connections and is cited by NIST as a supplemental control. Together, WPA and MAC filtering constitute two defensible security measures for a coffee-shop wireless network.

B. Not broadcasting the SSID offers almost no real security; the SSID still appears in probe-response and association frames and is trivially discovered with any 802.11 sniffer.

C. WEP uses RC4 with weak IV reuse and can be broken in minutes; NIST and IEEE both deprecate its use for any production WLAN.

1. NIST SP 800-153 “Guidelines for Securing Wireless LANs

” §3.2.2

pp. 14-15: “Organizations SHOULD use WPA2 or WPA… WEP is strongly discouraged.”

2. NIST SP 800-97 “Establishing Secure Enterprise WLAN Solutions

” §5.2

p. 5-7: “MAC address filtering can provide an additional layer of defense

although it is easily defeated.”

3. IEEE Std 802.11-2016

Clause 4.3.3 & Clause 12.4: defines WPA/WPA2 (RSN) protections; Annex C notes inherent weakness of WEP.

4. D. Johnston & J. Walker

“Overview of IEEE 802.11 Security

” IEEE Security & Privacy

vol. 3

no. 1

pp. 38-43

2005. DOI:10.1109/MSP.2005.11

5. A. Stubblefield

J. Ioannidis

A.D. Rubin

“Using the Fluhrer

Mantin

and Shamir Attack to Break WEP

” NDSS 2002 Proceedings

§3.1.