A security consultant is advising a client on securing their wireless infrastructure against denial-of-service (DoS) attacks. The client is particularly concerned about attacks that prevent legitimate users from associating with the access point or maintain existing connections. Which countermeasure directly addresses the vulnerability exploited by deauthentication and disassociation attacks?
- AImplementing strong WPA3 encryption
- BEnabling MAC address filtering
- CDeploying a wireless intrusion prevention system (WIPS)
- DUtilizing management frame protection (802.11w)
Show answer & explanationAnswer & explanation
Correct answer: D. Utilizing management frame protection (802.11w)
Management Frame Protection (802.11w) specifically addresses the vulnerability of unauthenticated management frames, such as deauthentication and disassociation frames. It encrypts and adds integrity checks to these frames, preventing attackers from spoofing them to disconnect legitimate users.
Why the other options are wrong
- A. While WPA3 is strong for data encryption, it doesn't inherently protect against deauthentication/disassociation attacks on management frames unless 802.11w is also implemented or leveraged by WPA3.
- B. MAC address filtering is easily bypassed by MAC spoofing and does not protect against deauthentication frames, which don't rely on MAC filtering for their exploit.
- C. A WIPS can detect and alert on deauthentication attacks, but 802.11w is the direct technical countermeasure that prevents the attack from succeeding in the first place.
802.11w (Management Frame Protection)
An IEEE standard that enhances wireless network security by providing integrity protection and confidentiality for management frames (such as deauthentication, disassociation, and beacon frames). This prevents attackers from forging these frames to disrupt network operations or perform denial-of-service attacks.
- Protects management frames from spoofing and tampering.
- Uses Message Integrity Check (MIC) for integrity.
- Crucial for mitigating deauthentication and disassociation DoS attacks.
Memory trick: 802.11w protects management frames from rogue disconnections.