Re: Need network security experts!!!!
Through the various posts here, it’s prolly evident to cricketplaya that there’s no such thing as bulletproof security. It’s about proper risk management and improving your odds
Spot on. The other variable is user inconvenience. Some of the strategies recommended do not offer protection, but inconvenience so why implement them?
MAC filtering: As most of you have said spoofing MAC is easy as 123. Will it stop a hacker? what impact will this have on the user. Constantly having to manually register devices on a white list, your pal comes in with his new IPhone he cant connect until you configure your access point to do so. Extra hassle really with nothing gained in security terms.
SSID: To connect to a wireless network you need the SSID. If you disable broadcasting of SSID from the access point (AP) it simply wont pop up up doing a scan for networks in most programs. But the small problem is 802.11 probe packets i.e. your device connecting to a (AP) MUST have the SSID in plain text, before authentication. Hacker simply waits and up pops the SSID, can even force devices to disconnect and reconnect. Again your pal with IPhone will need you configure his device. You just cant tell him the key.
Static IP: Once a hacker has access to your traffic offers nothing. Simply the case of viewing frames and packets to see the network topology. ARP helps too. Your pal problem again. Have fun trying to configure his device, most devices now assume DHCP would be running on the AP to save the user pressing awkward buttons.
Physical security: Physical security does work, but it is overkill for home user. You can get companies that will use directional antennas to make sure only your property is served by your signal but you need experience, rather difficult to do.
My Advice: Keep layer 2 secure as possible, this will prevent ACCESS to your network which is what you are most concerned about. To achieve this use (in order of preference): WPA2, WPA-AES, WPA-TKIP. Some older devices may only support WPA-TKIP, this is fine as only brute force attacks exist at the moment. Pick a good password with alphanumeric characters. A good method to avoid dictionary attacks is picking a phrase e.g. "Yeah i know you twat" would become Yikyt where only the first char of each world is written down. Add some numerals to that and you should have a good password, obviously longer.