Wi-Fi & 802.11 · Study deck

Wi-Fi Security: Access and Segmentation Controls

One shared Wi-Fi key can turn a lost sensor into a fleet-wide breach.

Radio Remi is your guide for this deck.

wifi-securityprovisioning-reviewcredential-management

Radio Remi, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: The story runs from onboarding and credentials through WPA mode, identity proof, key rotation, fleet recovery, and deprovisioning, because a device that is easy to join must also be safe to operate.
Explain: An attacker who flips a chosen delta $\Delta$ in ciphertext can compute the corresponding CRC delta, so the receiver can accept a predictably modified plaintext without the attacker knowing the secret key.
Explain: SAE resists the offline dictionary attack (a captured exchange cannot be replayed against a wordlist) and adds forward secrecy, so a later passphrase leak does not decrypt previously captured traffic.

Major section

Start With the Wireless Story

A support worker should not need one shared secret for every device.

An access point is the local radio device that joins Wi-Fi devices to a network.
Provisioning is the setup path that gives a device the right network details and its own trust record.
Recheck after code change.
Recheck after router change.

Major section

Start With the Wireless Story (continued)

A safe path must recover without falling back to a common password or an open setup mode.

The join must prove who the device is, who may set it up, and what it can reach.
A shared secret is easy to start, but one leak can affect many devices.
Recheck after owner change.

Major section

Start With the Wireless Story (continued)

The story runs from onboarding and credentials through WPA mode, identity proof, key rotation, fleet recovery, and deprovisioning, because a device that is easy to join must also be safe to operate.

A unique identity is safer to revoke, yet it needs more care and support.
A safe Wi-Fi join needs the access rule, observed authentication result, and a site plan for failed or revoked devices.
Wi-Fi security starts before the first normal packet.

Wi-Fi security provisioning flow from threat model through authentication, onboarding, credentials, segmentation, maintenance, and bounded decision.

Major section

Security Provisioning Record

One valid key should not open every service path.

Field support can change who or what is trusted at each step.
The final choice states its limits and names an owner; it does not just say setup is done.
A new owner, key change, code change, or network change must reopen the checks that it may affect.

Wi-Fi security and provisioning evidence record

Major section

Authentication Mode Review

Wi-Fi authentication is not one thing.

The key can be recovered from ordinary captured traffic in minutes.
WEP is broken for every use — if a device supports only WEP, treat that as a hardware end-of-life signal, not a setting to tune.
The IV must travel in the frame so the receiver can regenerate $Z$ .

Major section

Authentication Mode Review (continued)

RC4 expands that seed into keystream $Z$ , and encryption is the stream-cipher operation $C=P\oplus Z$ .

A 24-bit space has only $2^{24}$ values.
Merely avoiding one immediately repeated IV does not repair the construction.
CRC detects accidental transmission errors, but it is linear and unkeyed.
ARP frames have short, predictable fields.

Major section

Authentication Mode Review (continued)

An attacker who flips a chosen delta $\Delta$ in ciphertext can compute the corresponding CRC delta, so the receiver can accept a predictably modified plaintext without the attacker knowing the secret key.

Confidentiality and integrity therefore fail for different but reinforcing reasons.
An attacker can replay a captured ARP request so the network emits many related ARP responses, rapidly collecting IVs and RC4 samples instead of waiting for ordinary use.
WPA with TKIP was an emergency compatibility bridge.

Major section

Authentication Mode Review (continued)

The failure sequence is: observe a valid frame, stimulate repeatable traffic, collect public IV/ciphertext pairs, recover the shared key statistically, then decrypt or inject traffic.

Those changes made simple WEP-style reuse harder, but Michael was deliberately lightweight and weak.
TKIP is now legacy, not a safe fallback: require AES-CCMP or an approved modern WPA2/WPA3 suite and remove WEP/TKIP rates and modes from acceptance tests.
SAE resists the offline dictionary attack (a captured exchange cannot be replayed against a wordlist) and adds forward secrecy, so a later passphrase leak does not decrypt previously captured traffic.

Deck summary

Key takeaways

A support worker should not need one shared secret for every device.

A safe path must recover without falling back to a common password or an open setup mode.
The story runs from onboarding and credentials through WPA mode, identity proof, key rotation, fleet recovery, and deprovisioning, because a device that is easy to join must also be safe to operate.
One valid key should not open every service path.
Wi-Fi authentication is not one thing.

Retrieval practice

Recall check 1 of 4

Radio Remi says: answer from memory, then check your reasoning.

Q1A sensor uses a shared password and broad network access. What belongs in the approval record?

AThe password copied into the report for support

BUse a successful join screenshot to approve broad access

CA promise that firmware will never change

DCredential/support owners, access, recovery and retest

Show answer

Answer: D The decision must bound both onboarding and later operation.

Retrieval practice

Recall check 2 of 4

Radio Remi says: answer from memory, then check your reasoning.

Q2A team wants every deployed sensor to share one Wi-Fi password because it is easy to install. How should reviewers assess using one password for every deployed sensor?

ARequire a decision on credential rotation, lost-device response, and per-device identity

BApprove it, because a single shared password simplifies field support the most

CApprove it if the shared password is long and random, since that makes password guessing harder

DMove sensors to a wired network to reduce the chance of wireless credential interception

Show answer

Answer: A A fleet-wide shared Wi-Fi password needs a decision on rotation, lost-device response, segmentation, and per-device identity.

Retrieval practice

Recall check 3 of 4

Radio Remi says: answer from memory, then check your reasoning.

Q3A device credential leaks after installation. What must the provisioning design support?

AAssume the initial join proves future safety

BRevocation, replacement, reset, and recovery

CKeep the leaked credential for convenience

DOnly rename the device in the dashboard

Show answer

Answer: B A lifecycle plan limits the damage of exposure.

Q4A managed sensor fleet must remove one lost device without changing every device secret. Which model fits?

ACerts give each device owned enrollment and revocation.

BOne shared password for every sensor

CNo credential once a device has joined

DA printed serial number as network authorization

Show answer

Answer: A Individual identity allows a lost device to be revoked alone.

Retrieval practice

Recall check 4 of 4

Radio Remi says: answer from memory, then check your reasoning.

Q5A sensor authenticates to Wi-Fi but can contact every internal server. What should the release review require?

AA longer device display name for Wi-Fi.

BLogging disabled across the internal network.

CSegmentation and tested service access rules

DApproval based only on successful join

Show answer

Answer: C Authentication alone does not limit lateral reach.

Print reference

Answers

Answer key.

D · The decision must bound both onboarding and later operation.
A · A fleet-wide shared Wi-Fi password needs a decision on rotation, lost-device response, segmentation, and per-device identity.
B · A lifecycle plan limits the damage of exposure.
A · Individual identity allows a lost device to be revoked alone.
C · Authentication alone does not limit lateral reach.