Wireless Penetration Testing Methodology

RedTeam Security's Wireless Penetration Testing Methodology

It's uncommon nowadays for an organization to not have some form of a wireless network. But merely enabling wireless connectivity within an organization is not the same as deploying a wireless network. The differences in these tasks often lead to improperly configured environments, which can impact employees' productivity, network security, or data present in the environment.

What is a Wireless Penetration Test?

On its simplest of levels, a wireless penetration test can tell you which Wi-Fi devices exist within your environment and if your environment aligns with industry best practices. With more in-depth testing, an assessment can also examine the wireless infrastructure, performance, and security posture of an organization's Wi-Fi network(s). Doing so helps you fully understand your company's cybersecurity strengths and weaknesses.

RedTeam Security's wireless penetration tests are all-encompassing. Beyond the rudimentary "unauthorized access" testing methodology other security organizations offer as part of a wireless assessment, RedTeam Security digs deeper by following the same overall methodology as all of our comprehensive penetration tests.

Information Gathering

The information-gathering phase of a wireless network penetration test consists of network enumeration, identifying the SSIDs (network names) in scope and in range of your Wi-Fi network. Information gathering efforts result in a compiled list of metadata and raw output from automated tools to obtain as much information about the wireless network's makeup as possible. This step aims to collectively map the in-scope environment and prepare for threat identification and modeling.

Threat Modeling

With the information collected during Information Gathering, security testing transitions to threat-modeling where assets are identified and categorized into threat categories.

Vulnerability Analysis

The vulnerability analysis step in a wireless penetration test involves reviewing, documenting and analyzing vulnerabilities discovered as a result of information gathering and threat modeling. This includes the analysis of output from the various security tools and manual testing techniques leveraged in the previous steps. Vulnerability Analysis will include making a plan for exploitation and gathering exploits.

Exploitation

The Exploitation phase of a wireless penetration test involves establishing access to the wireless network, and potentially your internal network, through the bypassing of security controls and exploitation of vulnerabilities to determine their real-world risk. In a wireless penetration test, this also involves assessing the following potential areas of risk:

• Rogue Access Point Detection - RedTeam Security will work with your team to validate any alerting mechanisms you have or may need to correctly detect unauthorized Access Points in your environment. RedTeam Security will set up a Rogue Access Point that mirrors a valid access point and "trick" devices into connecting to it rather than your managed access point to test both detection and to obtain default usernames and passwords to gain access to your secure Wi-Fi networks, whether a guest network or for employees to connect to your internal network.
• Encryption Key and Password Strength - RedTeam Security will help your team gauge the strength and complexity of your wireless encryption (whether WEP, WPA2 or other), keys, and strong passwords, and their ability to be ‘brute force' or dictionary cracked. The configurations of your wireless routers will also be reviewed to ensure the network is secure.
• RF Signal Leakage - Working with your team, we can identify areas of signal bleed over or weak access areas internally within your organization.
• Network segmentation - Like a miniature internal network penetration test, our team will attempt to gain access to your internal network from your guest and authenticated wireless networks, to identify any weaknesses between your wireless environments and physical network firewalls that may need to be addressed.
• Egress filtering - By doing a packet-level examination, RedTeam Security can help your organization identify specific protocols or ports that establish outward connections from within your wireless environment.
• Captive portal testing - If your organization uses captive portals as a part of your wireless infrastructure, RedTeam Security will conduct basic testing against your application to ensure its integrity and security.

Throughout this step, we perform several manual tests simulating real-world attacks that are incapable of being performed through automated means. During a RedTeam Security penetration test, this phase consists of heavy manual testing tactics and is often the most time-intensive phase.

Reporting

The reporting step is intended to provide actionable results to the project stakeholders. RedTeam Security will compile, document and risk rate findings and generate a clear, actionable report, complete with evidence, for project stakeholders. The report will be delivered through the customer portal and can be reviewed via online meeting if desired.

Tools

To perform a comprehensive real-world assessment, RedTeam Security utilizes commercially available tools, internally developed tools and some of the same tools that hackers use on each assessment. Our intent is to assess your wireless network by simulating a real-world attack.

Here at RedTeam Security, we understand that your organization's security, performance, and productivity are too important to rely on simple guesswork. A security services vendor with a proven track record and experience in assessing all the critical needs of an organization's environment, including their business goals, can be an invaluable partner. RedTeam Security offers a wide variety of assessments and consulting engagements to ensure your organization meets its goals while maintaining peak productivity.

Many CEOs and Executives have been quoted saying, "We don't know what we don't know." This statement will forever reign true within any environment. So why not contact RedTeam Security today and allow us to help you identify your "unknowns''. Call (952) 836-2770 for a free consultation with a Penetration Testing expert today.