Securing Wireless and Mobile — Flashcards

A systematic assessment of the radio frequency environment in a physical area. Identifies existing access points (authorized and unauthorized/rogue), maps signal coverage, detects interference, and guides channel and AP placement. Should be repeated periodically — environments change as new devices appear, tenants move in, and physical spaces are modified. Heat maps are a key output.

Wireless survey tool (NetSpot, Ekahau, inSSIDer): shows 802.11 Wi-Fi devices only — SSIDs, BSSIDs, channels, signal strength. Best for AP inventory, channel planning, rogue AP detection, heat map generation.

Spectrum analyzer: shows ALL radio frequency activity across bands — including non-Wi-Fi sources (microwave ovens, baby monitors, cordless phones, Bluetooth). Use when standard survey tools show no problems but interference persists. The spectrum analyzer finds the invisible sources.

A visual overlay of wireless signal strength on a floor plan. Warm colors (red, yellow) = strong signal; cool colors (blue, purple) = weak signal. Security use: identifies where signal extends beyond intended boundaries — signal bleeding into parking lots or adjacent buildings creates external attack surface. Operational use: reveals dead zones and coverage gaps before deployment or after changes to the physical environment.

BYOD (Bring Your Own Device): Employee owns the device. MDM manages only the corporate partition. Organization has limited control; personal data outside organizational reach. Risk: device disposal, privacy tensions.

COPE (Corporate Owned, Personally Enabled): Organization owns the device; personal use permitted. Organization can wipe entire device at any time. Full organizational control.

CYOD (Choose Your Own Device): Variant of COPE — organization owns, employee selects from approved model list. Balances preference with organizational control.

Centralized mobile management platform. Key capabilities:

• Policy enforcement — pushes security configs automatically
• Feature control — enable/disable camera, Bluetooth, etc. by context
• App management — require/block specific apps
• Data segmentation — corporate and personal partitions
• Screen lock + PIN — protects lost/stolen devices
• Remote wipe — erases corporate data (or whole device) from console

Both BYOD and COPE devices are managed through MDM — the level of control differs based on ownership.

1. Data capture (eavesdropping): Attacker captures wireless frames in range.
Defense: Encrypt all traffic — WPA3, TLS, VPN on public networks.

2. On-path attack (rogue AP / ARP poisoning): Attacker inserts between client and network; reads/modifies traffic.
Defense: WPA3 Enterprise with certificate auth; avoid auto-connect to open networks; end-to-end TLS.

3. Denial of service (deauth / jamming): Forged deauth frames or RF interference disconnects clients.
Defense: 802.11w management frame protection (WPA3 enforces this); physical security.

A deauthentication attack sends forged IEEE 802.11 management frames that tell clients they have been disconnected from the access point. Clients accept and act on these frames immediately.

What makes it particularly effective: the attacker does not need to be authenticated on the network. Any device within Wi-Fi range can send these frames. Before 802.11w, management frames were not authenticated — no way to verify they came from a legitimate AP.

Defense: 802.11w (Management Frame Protection), which is mandated by WPA3, authenticates management frames so forged deauth frames are rejected.

1. Traffic monitoring: IMSI catchers (stingrays) impersonate cell towers, forcing devices to connect and allowing traffic interception; protocol downgrade attacks reduce encryption strength.

2. Location tracking: Cellular networks must know which cell a device is in to route communications — device location is continuously known to the carrier and can be obtained or leaked.

3. Global attack surface: A cellular-connected device is reachable from anywhere in the world — unpatched vulnerabilities are globally exposed, not just locally accessible. Keeping devices patched is critical.

Bluetooth: short-range (10–100m) wireless for Personal Area Networks — headsets, smartwatches, health monitors, car integration, external speakers.

Security model: pairing process establishes a shared key with user confirmation before first connection.

Risks:
• Unauthorized pairing if device accepts unknown connections
• Auto-connect to a spoofed familiar device (malicious device with same name)
• Eavesdropping after pairing

Best practices: Do not accept unknown pairing requests. Do not leave discoverable when not pairing. Disable when not in use.

Challenge: When an employee sells, trades in, or loses a personally-owned BYOD device, corporate data in the MDM work profile may still be on the device. A user-initiated factory reset may not reliably wipe the MDM work profile before the device changes hands. Without organizational confirmation, the wipe may never happen.

Control: Explicit BYOD offboarding procedure — IT must trigger a confirmed remote wipe of the corporate partition via MDM before the device is disposed of. Policy must require employees to notify IT before disposal, and IT must verify successful wipe completion before releasing the device. Without the procedure, the capability (remote wipe) is never used.