★ Starred in your notes: WPA3 (SAE / Dragonfly; AES-GCMP in enterprise) · remember CCMP for WPA2.
Breakdown 1 — Secure baselines
Establish (define the approved configuration — CIS Benchmarks, vendor guides) → Deploy (apply it with GPO/MDM/IaC/images) → Maintain (monitor for drift, re-apply, update the baseline when patches or requirements change).
From class — Chapter 11 system hardening: patching – secure configuration – application control. Trusted operating systems (evaluated/hardened OS builds). Endpoint security software: HIPS, FIM, DLP.
Breakdown 2 — Hardening targets
| Target | Hardening focus |
|---|---|
| Workstations / servers | Patch, remove unneeded software, host firewall, EDR, disable unused services, least-privilege accounts, secure baseline |
| Switches / routers | Change default creds, disable unused ports, SSH not Telnet, SNMPv3, port security, DHCP snooping, ACLs, out-of-band management |
| Cloud infrastructure | IAM least privilege, MFA, no public buckets, logging on, security groups, IaC scanning |
| Mobile devices | MDM, encryption, screen lock, no root/jailbreak, app allow lists |
| ICS/SCADA, embedded, RTOS, IoT | Segment/air-gap, change defaults, disable unused protocols, monitor passively, vendor firmware updates when possible |
Breakdown 3 — Wireless
Installation: site survey (walk the site, measure signal/interference) → heat map (visual coverage map) → place APs so coverage reaches users but not the parking lot; pick channels to avoid overlap.
Wireless security settings (class Chapter 6 — "remember"):
| Standard | Encryption | Status |
|---|---|---|
| WEP | RC4, static keys | Very insecure — never |
| WPA / TKIP | RC4 with TKIP | Deprecated |
| WPA2 | AES-CCMP (128-bit) — "replaced TKIP, uses AES; remember CCMP" | OK; PSK handshake can be captured and cracked offline |
| WPA3 | SAE (Simultaneous Authentication of Equals, a.k.a. Dragonfly handshake) in Personal; AES-GCMP (192-bit suite) in Enterprise; forward secrecy; protected management frames | Current best. "Anything dragon… is WPA3" |
- Personal = pre-shared key. Enterprise = 802.1X + EAP with a RADIUS server (AAA) — each user authenticates individually.
- EAP methods: EAP-TLS (certs both sides, strongest), PEAP / EAP-TTLS (server cert + tunneled user password), EAP-FAST. Avoid LEAP.
- Captive portal = the splash/login page on guest Wi-Fi (class).
- WPS (Wi-Fi Protected Setup) → easily brute-forced (class, Day 5) — the 8-digit PIN is checked in two halves; disable it.
- Cryptographic protocols = CCMP/GCMP; authentication protocols = EAP/RADIUS.
Breakdown 4 — Mobile solutions
| Topic | Know |
|---|---|
| MDM | "Can control devices from anywhere" (class): enforce encryption/PIN, push apps, remote wipe, geofencing, containerization of corporate data |
| BYOD | Employee-owned; privacy vs. control tension; use containers/MAM |
| COPE | Corporate-owned, personally enabled — company device, personal use allowed |
| CYOD | Employee picks from an approved list; company owns |
| Connection methods | Cellular (carrier network), Wi-Fi (evil twins/open networks), Bluetooth (bluejacking/snarfing — keep non-discoverable), also NFC/USB tethering |
| Mobile risks | Rooted/jailbroken devices, side loading, lost devices → full-device encryption + remote wipe |
Breakdown 5 — Application security
| Technique | Purpose |
|---|---|
| Input validation | Reject/sanitize bad input — the fix for injection, XSS, overflow |
| Secure cookies | Secure (HTTPS only), HttpOnly (no script access), SameSite (CSRF defense) |
| Static code analysis (SAST) | Scan source without running it; dynamic (DAST) tests the running app |
| Code signing | Verify publisher and integrity of releases |
| Sandboxing | Run untrusted code/apps in isolation (browser sandbox, VM, sheep-dip computer for media) |
| Monitoring | App logs, WAF logs, performance/error anomalies |
From class — software change management: obtain permission before installing software; think of the reboot video (change management, 1.3).
Exam tip: "Most secure home Wi-Fi setting" → WPA3 (SAE). "Enterprise Wi-Fi with per-user credentials" → WPA2/3-Enterprise + 802.1X/RADIUS/EAP-TLS. "Company wants control but employee keeps personal use" → COPE. "Find dead spots before installing APs" → site survey/heat map. "Prevent script from reading the session cookie" → HttpOnly.
Quick self-check
- What replaced TKIP in WPA2? (AES-CCMP.) And in WPA3 enterprise? (AES-GCMP.)
- What is SAE and which attack does it stop? (WPA3 handshake; offline dictionary cracking of captured handshakes.)
- BYOD vs. COPE vs. CYOD?
Sources: 20260917_173454.jpg, 20260917_173501.jpg, 20260917_182510.jpg, 20260917_182520.jpg, 20260917_182540.jpg, 20260918_175512.jpg