# Wireless Hardening: Enhancing Wi-Fi Security

Wireless hardening is crucial for securing networks against attacks. Several strategies can be implemented to maximize the security of wireless networks, striking a balance between protection and management complexity.

## 🔐 **Best Option: 802.1X with EAP-TLS**

* **EAP-TLS (Extensible Authentication Protocol - Transport Layer Security)**: Provides the highest level of wireless security by implementing **PKI (Public Key Infrastructure)**.
* **Components**: Requires a **RADIUS server**, **authentication back-end**, and client certificates signed by a trusted authority.
* **Complexity**: High overhead due to PKI deployment and certificate management, making it challenging for many organizations to implement.
  * **Client Certificates**: Must be distributed to all clients that authenticate to the network.
  * **Certificate Management**: Requires a system to sign and manage these certificates.

**Benefits**:

* Superior security if PKI is properly handled.
* Difficult for attackers to breach due to strong encryption and mutual authentication.

## ⚖️ **Alternative: WPA2 with AES/CCMP**

For companies that find **802.1X** too complex, **WPA2 with AES/CCMP** is a strong alternative.

### Steps to Enhance Security in WPA2:

1. **Long, Complex Passphrases**:
   * Prevent brute-force and rainbow table attacks by using a long passphrase that can't be found in a dictionary.
   * Increases computational effort required for attacks.
2. **Unique SSID**:
   * Avoid common SSIDs (e.g., "default" or "linksys") to minimize the risk of rainbow table attacks.
   * A unique SSID forces attackers to perform custom computations, which raises the attack difficulty.

## 🚫 **Avoid Using WPS (Wi-Fi Protected Setup)**

* **WPS**: Often enabled for consumer convenience, but it's a security vulnerability in enterprise environments.
* **Recommendation**: Disable WPS on your APs (Access Points) as it compromises network security.

### Additional Precautions:

* **Disable WPS in AP Management Console**: Ensure WPS is fully disabled in the settings.
* **Verify Using Tools Like Wash**: Sometimes, even if WPS is disabled in the console, it might remain active. Use external tools (e.g., **Wash**) to independently verify that WPS is indeed disabled.

***

By carefully selecting the right security mechanisms, either **EAP-TLS** for maximum protection or **WPA2 with AES/CCMP** for practicality, organizations can ensure robust wireless security. Disabling WPS and using complex passwords and unique SSIDs further strengthens defenses against potential attacks. 🔒
