Before we move on to those security solutions to fulfill their promises would be good to mention those
that don't
disabling SS our broadcasting has already been brought up even if we turned the broadcast off the SS
ID would still be admitted as these ideas are in clear text and probe request probe response Association
request and re Association request packets.
You can't hide it.
The first thing I'd like you to remember from this course is a warning not to turn off the CD broadcasting.
At best this will not affect your VLAN security but if you're less lucky you can decrease the security
substantially
static IP addresses can also be used to enhance security.
Almost all access points provide DHC server services.
This means that they allow connected clients to automatically configure the IP protocol you HTP servers
however are definitely not built with security in mind.
It would then seem logical to disable the server.
This however does little to improve security even though in this case an attacker who connects to an
access point would have to manually configure IP address and default gateway the information needed
for configuration is transmitted by an access point and clear text in UDP packets
UDP is a broadcast protocol and can certainly be received publicly this method only manages to delay
an attack by a minute or two.
The third solution is a MAC address control as you can see in the picture above.
All access points support adding a trusted MAC address list.
This method is sometimes exaggeratedly referred to as a MAC address based authentication mechanism.
What it really amounts to is simple filtering as you know from previous lectures.
It's very easy to change a MAC address.
It's just as easy to capture it as it's not secured in any manner.
We're an OSA model there too occupied by WPA WPA too.
Or rent the security measures protect data transmitted in upper layers but not in the second layer enabling
the filtering of MAC addresses will simply make your life harder in large vans.
There are many different Wi-Fi clients for example people from other branches of the company the MAC
address white list should be updated manually.
There's no automatic mechanism for that keeping a network like that would consume enormous amounts of
effort time and the security benefits that come with it are negligible
another approach you might come across.
Is that since we can't control radio wave access.
We should at least try to reduce the range of reception you can do this by lowering the strength of
the signal emitted by access points.
We can also use special paints to coat the rooms that contain access points and servers these pants
are quite expensive and it's doubtful whether they're truly effective.
They do block out transmitted signals to some degree but they don't Warum that an outside user will
not be able to connect to your access point.
Artificially reducing access point and signal strength only makes it difficult for authorized users.
They'll have problems connecting to a network an attacker can always afford a bigger antenna.
And we're back to the rule.
The bigger the antenna the better.