Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the physical access point where both sets of wireless data propagate through?

share|improve this question
I'm curious, what AP are you using? – mikeazo Dec 28 '11 at 13:16
@Ian - we encourage questioners to accept the question they feel best answers their question (click on the tick next to the answer) - this encourages people to answer by providing them with reputation points, and you get a rep reward as well. – Rory Alsop♦ Jan 26 '12 at 16:04

4 Answers

up vote 5 down vote

Quite a lot of "enterprise" type access points offer functionality to allow multiple SSIDs on a single AP, and it's a pretty common configuration from what I've seen.

From a logical perspective the networks should be isolated (using VLANs or similar type of segregation). You should also be able to specify different authentication mechanisms, encryption types etc.

If correctly configured and patched, this shouldn't pose a major risk, however it does increase the complexity of the environment which always poses security risk (ie, one logical misconfiguration can cause a serious issue)

In terms of the Denial of Service risk, wireless networks can effectively always be DoS'd if an attacker wants to as a powerful enough radio source can cause denial of service on the signal and things like Deauth floods are pretty hard to stop too, from what I've seen.

share|improve this answer
Hi, thanks for replying. My emphasis is that by giving a relatively unsecure network to visitors, could this compromise the secure network because they're both using the same physical AP? Or are you saying that someone wouldnt even need to be on either network to cause a DoS to the secure network? – Ian Dec 27 '11 at 17:01
If you route the "insecure" network straight out to the Internet (presuming you don't need to provide internal resources to visitors) then at an IP level it shouldn't interact with the "secure" network, so there should be no risk of compromise from that point of view (although see the point in my main answer about complexity). DoSing any wireless network can be done on the radio side, whether it's "secure" or "insecure" doesn't matter, as the attacker doesn't need to connect to it to carry out the attack – Rory McCune Dec 27 '11 at 17:19
If you have to ask, you probably want to hire someone who really knows their stuff to setup your stuff. It's somewhat easy to muck up if you've never dealt with vLAN specific SSIDs and such before. But yes it's possible and common as Rory says. – Chris S Dec 27 '11 at 19:19
Thanks Chris, I will definitely get someone else to implement! Thanks Rory – Ian Dec 27 '11 at 20:37
up vote 2 down vote

Right! Your AP becomes a single point of failure and the key to the castle, if someone happens to get a privileged access to your public network by compromising your access point, your secured network isn't anymore!

share|improve this answer
Hi, could you just elaborate on "privileged access", do you mean a higher-type of access than a normal visitor would have on the visitor network? – Ian Dec 27 '11 at 17:02
up vote 0 down vote

If i understood your question..it depends, if you set a diferent network segment for each wireless network, users wont be able to comunicate with each other across those networks.

share|improve this answer
I presume you could DoS the router, which would affect the other network? – Ian Dec 27 '11 at 14:45
and when you say "communicate" do you mean it'd be physically impossible even if you spoofed parts of packet headers? – Ian Dec 27 '11 at 15:08
up vote 0 down vote

As both Serge and Rory mentioned, it would require an exploit in the firmware of the Access Point, so if you can access the Access Point and configure it, your more secure network would be compromised. As for VLAN security, there is some best practices, Check this link on Cisco VLAN Best Practices

All in all, I would not recommend you to have two segmented wireless network, unless it is really needed I would skip the high-consequence network (the one with access to workstations, servers, domain controllers etc) and only have a guest network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.