I need to design a contingency plan for a WPA2-Enterprise WIFI network.

In the past we have been designing applications that can work autonomously without internet connection (for example, caching the information locally and send it over all together when a connection is available). Unfortunately, this is no longer possible with some solutions.

I've been thinking that disabled WPA2-PSK WiFi Access Points that are ready to be enabled may be agile and secure enough to recover from a disaster. what do you think?

  • Not entirely clear what you mean by "contingency plan for a WPA2-Enterprise WIFI network." What specific problems are you looking to build redundancy/resiliency for? If you have problems with the WiFi? The network? The RADIUS authentication? Client drivers/OS issues? Power/UPS issues? WPA2 using PSK requiring manual intervention only poorly covers one of those especially when proper redundancy of RADIUS and your user directory service should prevent that cause from being a problem. – YLearn Jul 27 '18 at 2:04
  • @YLearn for example, the MDM get crazy and revokes all client certificates that allow connection to the WPA2-Enterprise wifi. – Forced Port Aug 18 '18 at 6:48
  • I think the answer here massively depends on how large and complex your WLAN is. Are you talking multiple sites, each with many overlapping wifi devices? We would also need to know if you are looking for resiliency against a malicious attack, or just the existing setup failing in some way. Are you prepared to double up on wifi hardware for example? – Matt G Aug 25 '18 at 16:13
  • @MattG assume cost effective solution but the priority is resiliency so I can double wifi hardware if needed. I'm looking for resiliency for both an attack and the setup failing. – Forced Port Aug 27 '18 at 8:45
  • Security is a layered approach , you need to tell us what your trying to do. Are you looking for a solution to confidentiality, availability ,integrity?. – binaryOps20 Jan 12 at 12:35

WPA2-Enterprise is usually used in order to automatically provision access to a large amount of machines, in a dynamic pool.

WPA-PSK is as secure as the password you use so it is a replacement solution, from the security perspective (provided you have a good enough password). Operationally it can become a nightmare if you have more than a handful of machines.

You could pre-populate the password but you need to plan it in advance, account for PSK changes etc.

  • The problem with the "good enough" password is that in a big company with a lot of people that mantain the devices, is that a lot of people know the password. And they can leak it in forums, to friends or in other ways (putting the password in a manual that then is uploaded to Internet for whatever reason). If in addition I mantain the wifi off till is needed it seems better for me but I'm not sure this is an agile enough solution in case of disaster. – Forced Port Jun 26 '18 at 11:34
  • 1
    @ForcedPort: yes, you essentially captured all the drawbacks. I ran in a previous life very large systems and I would not have gone that way in any case. Too risky (the leaks you mention) and too unstable (PSK changes). – WoJ Jun 26 '18 at 11:36
  • If your company is using Windows Enterprise edition, you can add computers to a domain and have the wireless credentials managed and inaccessible to the users, that could help diminish the nightmare caused by having more than a handful of machines, and the difficulty of pre-populating the password. This depends on what you're using, obviously. – xorist Sep 24 '18 at 15:40

Short answer:

It depends on what sort of threat you're designing your contingency for. For example, if you're worried about deauth attacks or someone jamming the parts of the RF spectrum used by your WiFi network, having a backup network won't help if it's vulnerable to the exact same attack.

You'd be better off using a wired network for the really critical systems, and either accept the risk that you might lose the wireless ones or use something more robust than WiFi (such as 5G).

Longer answer:

In general, relying on wireless communications for critical applications is problematic. Protection against jamming attacks has been part and parcel of military communications systems since World War II, but this protection is never really considered in civilian systems (protection against unintentional interference is a different issue).

This is for good reason: compared with confidentiality protections like encryption, properly protecting against jamming attacks requires very severe trade-offs in system performance, and those trade-offs just aren’t justifiable in civilian systems which aren’t intended to withstand a military threat.

For example, strategic military satellite communications links—designed to withstand intense jamming attacks and still provide reliable nuclear command & control—have data rates measured in kilobits per second. Even if 802.11 or 4G LTE are (by comparison) hopelessly vulnerable to jamming attacks, that sort of speed decrease isn’t a compromise anyone in the civilian world would be willing to make. Jamming is a risk, but it’s a risk which isn’t worth mitigating.

Another factor in this equation was that jamming historically required specialised hardware of the sort only the military had easy access to. It’s also very illegal to jam commercial communications systems in most countries, which made manufacture of this sort of hardware not worth the effort even if you wanted to try it.

These days, however, Software Defined Radio has massively decreased the barrier of entry to anyone who wants to play with radio signals, and it no longer requires thousands of dollars in specialised equipment if you want to do something (again, very illegal) such as jamming or spoofing nearby GPS receivers.

(Some of the above paragraphs paraphrased from here)

Not the answer you're looking for? Browse other questions tagged or ask your own question.