CND (312-38) Network Defense Simulation
Master wireless network hardening. Learn to identify and correct misconfigurations that leave corporate infrastructure vulnerable to unauthorized access and wardriving attacks.
Network Scenario
You are conducting a security audit of a newly acquired subsidiary's wireless infrastructure. During a physical site survey of the perimeter, you run a passive RF scan using Kismet. The results show several Access Points (APs) broadcasting default configurations. Upon logging into the Wireless LAN Controller (WLC), you discover that the previous IT administration left the wireless networks in a highly vulnerable state, increasing the risk of unauthorized access and lateral movement into the corporate intranet. You must identify the correct best practice to begin hardening the wireless network.
Traffic & Logs
Question
Which of the following is a best practice for wireless network security?
Hint: Consider which option actively reduces the visibility of your wireless network to casual scanners, automated scripts, or wardrivers passing by the building.
Post-Incident Review
1. What is happening in the network
The wireless infrastructure audit reveals significant misconfigurations. The APs are broadcasting a default SSID ("default"), allowing remote management access, and providing unresticted routing into the corporate intranet without any segmentation or firewalling.
2. Identify attack or behavior
Attackers utilizing techniques like wardriving rely on broadcasted default SSIDs to map vulnerable hardware models. By recognizing a default SSID like "Linksys" or "default," attackers know exactly which default administrator credentials to attempt. Furthermore, unrestricted remote access allows brute-force attacks directly against the management interface.
3. Why correct answer is correct
B. Using SSID cloaking is considered a baseline best practice. By disabling the SSID broadcast, the network name does not appear in the "available networks" list on a casual user's device. While it is not a foolproof security measure against advanced adversaries using packet sniffers, it significantly reduces the attack surface against automated scanning tools and casual attackers.
4. Why others are wrong
- A. Do not placing packet filter: Incorrect. You must use packet filtering (firewalls) between untrusted APs and the internal corporate network to enforce segmentation.
- C. Do not changing the default SSID: Incorrect. Default SSIDs must always be changed to prevent attackers from easily identifying the hardware vendor and executing specific exploits.
- D. Enabling the remote router login: Incorrect. Remote management from external/untrusted interfaces should be disabled to prevent brute-force and dictionary attacks against the admin portal.
5. Defensive action
The immediate remediation plan must include: Disabling SSID broadcasting for sensitive internal networks, changing all default SSIDs and administrative credentials, disabling remote management from non-management VLANs, and deploying a strict firewall (packet filter) between the wireless network controller and the core intranet.
MINI LESSON: Security Through Obscurity vs. Defense-in-Depth
In modern network defense, "SSID Cloaking" is often debated because tools like Airodump-ng can still discover cloaked SSIDs by analyzing probe requests from legitimate clients. However, in security frameworks, it is still categorized as a valid first layer of defense. It acts as "security through obscurity." While it shouldn't be your only defense, when combined with strong encryption (WPA3), 802.1X authentication, and network segmentation, it effectively filters out low-effort, opportunistic attacks.