Within my organisation we're being asked to provide a secure but seamless wireless experience e.g. user logs on to Windows device and are connected automatically to corporate network via wireless. Implementing WPA2-Enterprise using certs (EAP-TLS) for authentication seems to be deemed 'industry best practice' from a security perspective but there seems to be little mention of how certificates should be protected. (Note: we have an internal CA so this pre-req is met)
Windows certificate store allows certificates to stored in software and marked as non-exportable but if rogue admins or malware get SYSTEM privileges, I believe tools such as Mimikatz can be used to extract private keys for later abuse.
Smartcards are obviously the most secure option for storing the private keys but we don't use them and its not something we can roll out just for this use-case
In theory the other secure option would be to utilise TPMs to store the private keys. All modern hardware has them built in and from Windows 8 onwards it seems you can use the Platform Crypto Provider to store keys in the TPM. When I search for wireless auth deployments using TPMs or the Platform Crypto Provider however I'm getting nothing useful which is concerning me.
My questions are therefore:
- Can Windows Platform Crypto Provider (using the TPM) be used for wireless authentication?
- Can it be implemented without PINs? (yes PINs are more secure but the business are asking for a seamless experience)
- Why does this not appear to be commonplace? Are people just deeming software storage secure enough or are they using other vendor solutions where it's done out of the box magically?
- If people are relying on the windows cert store do they have processes to revoke certs e.g. whenever a device has a malware detection? (Seems clunky plus it's the malware we don't detect that we really need to worry about)
Thanks in advance for responses!