0

I have a scenario where a Network Access Control (NAC) controlls the acces to a SSID (username and password), so the wifi controller doesnt have a password for it. Obviously the mobile devices complain about not being secure.

Question a) If I use a very simple password in the wifi controller and let everybody know it, eventualy even the attackers will know it. Right? (and would be able to place a sniffer anyway)

Question b) If I put a TLS certificate in the controller, Does all the mobile devices (or almost all) will use it withowt complain if is bought from a known company?

Question c) Any suggestions?

Thank you.

Improve this question
4
  • My first suggestion is to describe the environment. A hotel with guest using wifi? A schoo? A home? A business office? Retail location? Who uses the wifi and are they employees, strangers, paying customers, free users? What do the users need to access? Sensitive medical data? Internet only? Business documents? Those factors determine the security posture and access users should be given.
    – FrameHowitzer
    Commented May 29, 2023 at 17:31
  • Hi. The users are employees using their own devices. I guess they maybe make even banking transactions there. I'm not comfortable leaving it like this.
    – elysch
    Commented May 30, 2023 at 2:22
  • For a work/office environment where the wifi is for employee convenience (phones, tablets, laptops) and not their primary network connection (wired network to desktops), I would recommend the wifi be WPA2/WPA3 encrypted with a complex password. Make sure the wifi network has no access to any secure resources and have employees use it simply as internet access like at home. Access to company resources is via VPN only.
    – FrameHowitzer
    Commented May 30, 2023 at 14:46
  • If you want to use more complex authenticated access, 802.1x EAP is fine but requires more work and integration with user devices. If employees use wifi as their primary network access to company resources then you should use the more complex authentication option and still make sure that company resources are accessed via encrypted and authenticated methods (HTTPS with user login etc.).
    – FrameHowitzer
    Commented May 30, 2023 at 14:48

1 Answer 1

Reset to default
1

Yes. That's the key drawback to a shared password. It's only "secure" by who you tell. From there it's not much of a secret at all. (there are numerous programs that will read the configuration and tell you the password on practically every OS ever made.) If you put a single, static certificate, all you've done is trade a small password for a much larger one. It's only slightly less insecure because it's not something anyone will remember or be able to say.

What you want is 802.1x enterprise authentication. (vs. personal / shared key) That's why that mode exists. There are various EAP's from simple user/pass to complex certificates. As there is one per user, a single token can be disabled / changed without disrupting everyone else. Plus, each users traffic is uniquely encrypted.

Improve this answer
2
  • Nice to know. I'll investigate more about this. Thank you very much.
    – elysch
    Commented May 30, 2023 at 2:17
  • Now that I think about it, I think 802.1x is what we are using... but it isn't integrated to the wifi controller. It's on a separate device (NAC). Am I right? The problem is to find a way to add security in the wifi controller,i guess.
    – elysch
    Commented May 30, 2023 at 2:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.