Wireless security encompasses the protocols, techniques, and defensive measures used to protect wireless networks and devices from unauthorized access and attacks. Operating at the physical and data link layers, wireless networks face unique vulnerabilities compared to wired infrastructure — including signal interception, authentication bypass, and protocol exploitation. Understanding both defensive configurations (WPA2/WPA3, 802.1X, proper encryption) and offensive techniques (deauthentication, evil twin, KRACK) is essential for securing modern wireless deployments. A critical insight: most wireless compromises succeed not because of protocol weaknesses, but because of misconfigured or legacy settings that expose enterprise networks to trivial attacks.
What This Cheat Sheet Covers
This topic spans 14 focused tables and 110 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Core Security Protocols
These are the encryption and authentication standards that gate access to a Wi-Fi network, lined up from today's gold standard down to the relics you should never touch. Reading them top to bottom tells the whole story — WPA3 fixing the offline-cracking weakness of WPA2, enterprise modes handing each user their own keys, and WEP sitting at the bottom as a cautionary tale that falls in minutes.
| Protocol | Example | Description |
|---|---|---|
mode: WPA3-SAEpsk: complex_passphrase | • Uses Simultaneous Authentication of Equals (SAE) instead of PSK • provides forward secrecy and resistance to offline dictionary attacks • mandatory for Wi-Fi 6 certification | |
mode: WPA3-Enterpriseauth: 802.1X-EAP-TLS | • Requires 192-bit minimum security suite • uses GCMP-256 for encryption and HMAC-SHA-384 for integrity • mandates certificate-based authentication in high-security modes | |
mode: WPA2-PSKencryption: AES-CCMPpsk: shared_key | • Uses pre-shared key and 4-way handshake for authentication • employs AES-CCMP for encryption • vulnerable to offline dictionary attacks if weak passphrase used | |
mode: WPA2-Enterpriseauth: RADIUS + EAP-PEAPencryption: AES-CCMP | • Authenticates users via RADIUS server using EAP methods • each user gets unique encryption keys • supports certificate or username/password authentication depending on EAP type |