Different Wi-Fi security levels under same private subnet

Question

I'm working on an assignment and I'm given a hypothetical scenario where:

A company has a local subnet where everything shares the flat address space 192.168.0.0/8 (this means that any device can communicate with any other device else in the network). There are 2 sections: the administration buildings and the factory. The machines in the factory have their own Programmable Logic Controller (PLC) and they use open (unencrypted) Wifi to communicate. The administration PCs also use Wifi, but with WPA2 security. Both section devices can communicate among themselves or with the other party.

I want to ask about the setup. How is it possible that a single local area network can have different Wifi security levels. Aren't the devices supposed to be under the same network? And if it's possible, is it pointless to have WPA2 security for the office PCs, as I can just join the open Wifi network anyway. And say if I'm Trudy, am I able to sniff everything going on in this network, assuming no access control is implemented? Isn't this a major security flaw?

Thanks everyone.

Answer 1

A company has a local subnet where everything shares the address space 192.168.0.0/8.

Let me start out by stating that "shares the address space" does not equate to "shares the same subnet." Multiple different L3 domains can all be part of a shared address space. Any /8 is really too large to be usable as a single subnet and you will end up with a number of problems.

Second, I really hope that they aren't using a 192.168.0.0/8 as this address space includes both publicly assigned address space as well as RFC1918 address space. This would be terrible network design and indicate there are likely other issues as well (i.e. I have personally never seen a network with this kind of design flaw that didn't have others as well).

How is it possible that a single local area network can have different Wifi security levels. Aren't the devices supposed to be under the same network?

A single local area network can consist of many different VLANs and subnets each with their own access/security policy. Or you can have different ESSIDs that bridge their associated clients to the same VLAN/subnet.

And if it's possible, is it pointless to have WPA2 security for the office PCs, as I can just join the open Wifi network anyway.

Certainly not pointless, even if the two ESSIDs do provide access to the same VLAN/subnet for clients. The payloads of the wireless frames sent and received by stations connected with WPA2 will be encrypted. This makes interception over the air more difficult if not impossible.

Even if stations connected to the two different ESSIDs can communicate with each other, this does not mean that joining the open ESSID will provide you the same access that joining the WPA2-PSK ESSID does.

And say if I'm Trudy, am I able to sniff everything going on in this network, assuming no access control is implemented?

All wireless traffic that "Trudy's" station can capture (the stations must have a high enough signal to understand the data rate at which it is transmitted)? Possibly if only a single PSK is in use and Trudy has that PSK. All the wired traffic? Unless the wired traffic is vulnerable to some sort of other exploit, no.

However, wired traffic should be relatively safe in this situation. As for the single PSK, there may be different PSKs configured in different facilities or depending on vendor there may be some sort of private/dynamic/identity PSK feature enabled that can make use of different PSKs to different stations.

Isn't this a major security flaw?

Maybe? There really isn't enough information in your question to determine what level of security risk may be present. This could be a major security issue, or it could be non-existent. All depends on what is really happening "under the hood."

Answer 2

It's pretty common and normal to have multiple SSIDs on the same subnet, with different authentication methods. For example, one may be using RADIUS authentication and another may be using a PSK. Both assign IP addresses on the same subnet, but maybe some devices don't support WPA2-Enterprise auth. so you need to use the PSK SSID for them. You can still lock down the SSID to only allow specific devices to use it, so everything else requires using the RADIUS authenticated SSID.

Of course, if you CAN separate the SSIDs onto their own subnets, it would be better from a security standpoint but sometimes that's not an option or the devices all need to be on the same subnet due to certain protocols being used.