<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-wireless-access-point-hardening
description: >-
  Wireless access point security hardening including WPA3 configuration, management frame protection, SSID security, radio configuration, firmware management, and administrative access controls.
domain: cybersecurity
subdomain: wireless-security
tags:
  - ap-hardening
  - wpa3-config
  - pmf
  - wireless-config
  - cis-benchmarks
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1200", "T1600"]
  nist-csf: ["PR.AC-5", "PR.IP-1", "PR.PT-3"]
  uuid: 38250192-f6df-4c46-8857-eb1f0a831924
---

# Implementing Wireless Access Point Hardening

## Overview

Access point hardening reduces the wireless attack surface through secure configuration.
This covers WPA3 enforcement, Protected Management Frames (802.11w), SSID policies, radio
configuration best practices, firmware lifecycle management, and administrative access
controls. Configuration examples target enterprise-grade APs from common vendors using
CLI and API interfaces.

Mode: `[MODE: ARCHITECT]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Administrative access to wireless infrastructure | Required |
| AP management platform (controller or cloud-managed) | Required |
| CIS Benchmark for wireless infrastructure | Required |
| Change management approval for configuration changes | Required |
| Firmware update packages from vendor | Required |

## Key Concepts

### AP Hardening Checklist

```
Wireless AP Hardening:
├── Authentication & Encryption
│   ├── WPA3-Enterprise with 192-bit security
│   ├── Protected Management Frames (802.11w) required
│   ├── Disable WPA2 transition mode where possible
│   └── RADIUS server certificate validation
├── SSID Configuration
│   ├── Disable SSID broadcast for sensitive networks
│   ├── Separate SSIDs per security zone
│   ├── Client isolation on guest networks
│   └── Maximum association limits per SSID
├── Radio Configuration
│   ├── Minimum RSSI thresholds (band steering)
│   ├── Disable legacy 802.11b rates
│   ├── DFS channel support enabled
│   └── Transmit power optimization
├── Administrative Controls
│   ├── Change default credentials
│   ├── Disable HTTP management (HTTPS only)
│   ├── SNMPv3 or disable SNMP entirely
│   └── Management VLAN isolation
└── Firmware & Lifecycle
    ├── Automated firmware update verification
    ├── Configuration backup and version control
    └── End-of-life monitoring
```

### WPA3 Enterprise Configuration

```bash
# hostapd WPA3-Enterprise configuration
cat > /etc/hostapd/hostapd.conf << EOF
interface=wlan0
driver=nl80211
ssid=CORP_SECURE
hw_mode=a
channel=36
ieee80211n=1
ieee80211ac=1
wmm_enabled=1

# WPA3-Enterprise (SAE + 802.1X)
wpa=2
wpa_key_mgmt=WPA-EAP-SHA256 WPA-EAP-SUITE-B-192
rsn_pairwise=CCMP GCMP-256
ieee80211w=2

# RADIUS configuration
auth_server_addr=10.0.0.10
auth_server_port=1812
auth_server_shared_secret=CHANGE_ME_STRONG_SECRET
acct_server_addr=10.0.0.10
acct_server_port=1813
acct_server_shared_secret=CHANGE_ME_STRONG_SECRET

# Protected Management Frames — required
ieee80211w=2

# Disable legacy rates
supported_rates=120 180 240 360 480 540
basic_rates=120 240
EOF

sudo hostapd /etc/hostapd/hostapd.conf
```

### Management Access Hardening

```bash
# Disable HTTP management — HTTPS only (example: OpenWrt)
uci set uhttpd.main.listen_http=''
uci set uhttpd.main.listen_https='0.0.0.0:443'
uci commit uhttpd
/etc/init.d/uhttpd restart

# Restrict management to specific VLAN
uci set network.mgmt=interface
uci set network.mgmt.proto='static'
uci set network.mgmt.ipaddr='10.0.99.1'
uci set network.mgmt.netmask='255.255.255.0'
uci commit network

# Disable unused services
for svc in telnet snmpd miniupnpd; do
  /etc/init.d/$svc stop 2>/dev/null
  /etc/init.d/$svc disable 2>/dev/null
done

# Set strong admin credentials
passwd root
# Enforce key-based SSH only
uci set dropbear.@dropbear[0].PasswordAuth='off'
uci set dropbear.@dropbear[0].RootPasswordAuth='off'
uci commit dropbear
```

### Firmware Verification

```bash
# Download and verify firmware integrity
wget https://vendor.example.com/firmware/ap-v2.4.1.bin
wget https://vendor.example.com/firmware/ap-v2.4.1.bin.sha256

# Verify checksum
sha256sum -c ap-v2.4.1.bin.sha256

# Backup current configuration before upgrade
scp root@ap:/etc/config/* ./backup/
tar czf ap_config_backup_$(date +%Y%m%d).tar.gz ./backup/

# Apply firmware (example: sysupgrade)
scp ap-v2.4.1.bin root@ap:/tmp/
ssh root@ap "sysupgrade -v /tmp/ap-v2.4.1.bin"
```

## Workflow

### Step 1: Configuration Audit

```bash
# Audit current AP configuration against CIS benchmarks
ssh root@ap 'uci show wireless; uci show network; uci show firewall'
```

### Step 2: Authentication Hardening

Enable WPA3-Enterprise with PMF required on all corporate SSIDs.

### Step 3: Radio Optimization

Disable legacy rates, enable band steering, set minimum RSSI thresholds.

### Step 4: Administrative Lockdown

```bash
# Restrict management access to dedicated VLAN
# Disable HTTP, telnet, SNMPv1/v2
```

### Step 5: Firmware Update

Apply latest firmware with integrity verification and configuration backup.

## Detection

```yaml
title: Wireless Access Point Hardening Detection
id: 61ed32d3-cc88-4f7f-aa03-f2614e5a799c
status: experimental
description: Detects suspicious activity related to implementing wireless access point hardening techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1200
  - attack.t1600
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Access Point Hardening Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1200, T1600 |

## Verification

- [ ] WPA3-Enterprise configured with PMF required
- [ ] Legacy 802.11b rates disabled on all radios
- [ ] Management access restricted to dedicated VLAN
- [ ] Default credentials changed on all devices
- [ ] Firmware current and integrity verified
- [ ] Configuration backed up and version-controlled

## References

- CIS Controls v8 — 4.1 Establish Secure Configuration Process
- NIST SP 800-153 — Guidelines for Securing Wireless LANs
- Wi-Fi Alliance WPA3 Specification
- [hostapd documentation](https://w1.fi/hostapd/)
