Enterprise Wireless Security

Every wired security control assumes an attacker needs physical or logical access to a cable, switch port, or routed path to see traffic. Wi-Fi removes that assumption entirely: any device with a radio inside range can receive every frame transmitted on a channel, whether or not it is the intended recipient. This is why wireless security engineering treats the RF medium itself as untrusted infrastructure, and why every control covered in this course — from SAE to PMF to WIDS — exists to compensate for the fact that the transmission medium cannot be physically secured the way a cable plant can.

This also means wireless security work sits at the intersection of two disciplines that don't always overlap in a typical security career: RF/networking engineering (coverage, channel planning, interference) and cryptographic/identity engineering (authentication, key management). A misconfiguration in either layer can undermine the other — a perfectly configured WPA3-Enterprise SSID broadcasting at excessive power past your building's perimeter is still leaking more attack surface than it needs to.

802.11 defines three broad frame categories that matter for security work. Management frames (beacons, probe requests/responses, association, authentication, deauthentication, disassociation) coordinate the network and, critically, were unauthenticated and unencrypted under WPA2 unless Protected Management Frames (802.11w) was explicitly enabled — this is the root cause of deauthentication-based attacks covered in Module 8. Control frames (RTS/CTS, ACK) manage medium access and channel contention. Data frames carry the actual payload and are what encryption (CCMP/GCMP) protects.

A Basic Service Set (BSS) is a single access point and its associated clients, identified by a BSSID (the AP radio's MAC address). An Extended Service Set (ESS) is multiple APs sharing the same SSID and backend, letting a client roam between physical APs without re-authenticating from scratch (fast roaming via 802.11r reduces that handshake overhead further). Understanding this distinction matters operationally: a WIDS baseline (Module 4) is built around expected BSSIDs per SSID, and an unexpected BSSID broadcasting a known SSID is one of the strongest rogue/evil-twin indicators available.

The 2.4 GHz band has only three non-overlapping 20 MHz channels (1, 6, 11 in most regions) and is heavily congested by legacy devices, Bluetooth and non-Wi-Fi interference (microwave ovens, some cordless phones). It propagates further and penetrates walls better than 5 GHz, which is a security-relevant tradeoff: better in-building coverage also means more RF bleed past your perimeter for the same transmit power.

5 GHz offers far more channels and higher throughput but shorter range and worse wall penetration, and a large portion of it falls under Dynamic Frequency Selection (DFS) obligations covered in depth in Module 7 — those channels require radar detection before and during use. 6 GHz (Wi-Fi 6E and Wi-Fi 7) opened a large new block of spectrum that, notably, mandates WPA3 and does not permit WPA2 or open authentication at all — any 6 GHz deployment is a WPA3-only deployment by regulatory requirement, which simplifies the transition-mode risk discussed in Module 2.

802.11 uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) — a station listens before transmitting and backs off if the medium is busy, since collisions can't be reliably detected mid-transmission the way wired Ethernet can. This shared-medium behavior means RF planning decisions (channel width, transmit power, AP density) directly affect both performance and the attack surface a security team has to reason about, which is why Module 6 treats site survey as a security deliverable, not just a coverage one.

• •Wider channels (40/80/160 MHz) increase throughput but consume more of the limited non-overlapping channel pool, often forcing more APs onto DFS spectrum.
• •Higher transmit power extends both legitimate coverage and the range from which an attacker can passively observe or attempt association.
• •Channel overlap and co-channel interference are availability problems first, but an unstable RF environment also makes it harder to distinguish an attack (deauth flood, jamming) from ordinary interference in monitoring logs.