<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-enterprise-wireless-security
description: >-
  Comprehensive enterprise wireless security audit covering 802.1X/RADIUS, network segmentation, guest network isolation, AP hardening, and compliance with CIS and NIST standards.
domain: cybersecurity
subdomain: wireless-security
tags:
  - enterprise-wifi
  - 802.1x
  - radius
  - wireless-audit
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1200", "T1040"]
  nist-csf: ["PR.AC-1", "PR.AC-5", "PR.PT-4", "DE.CM-1"]
  uuid: edc79e02-cf48-47f1-b101-3fee02415beb
---

# Auditing Enterprise Wireless Security

## Overview

Enterprise wireless security auditing provides comprehensive assessment of corporate Wi-Fi
infrastructure including 802.1X/RADIUS configuration, EAP method security, certificate
validation, guest network isolation, VLAN segmentation, AP hardening, management interface
security, and compliance with CIS Wireless Benchmarks and NIST guidelines.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Network diagram with AP placement and VLAN design | Required |
| RADIUS server access for configuration review | Required |
| AP management console access | Required |
| Wireless controller configuration export | Required |
| CIS Wireless Benchmark or applicable compliance framework | Required |
| wpa_supplicant for 802.1X testing | Required |

## Key Concepts

### Enterprise Wireless Architecture

```
Enterprise Wi-Fi Security Stack:
├── Authentication (802.1X/RADIUS)
│   ├── EAP-TLS — certificate-based (strongest)
│   ├── EAP-PEAP — server cert + password
│   ├── EAP-TTLS — tunneled authentication
│   └── EAP-FAST — Cisco, token-based
├── Encryption
│   ├── WPA3-Enterprise (192-bit Suite B)
│   ├── WPA2-Enterprise (CCMP/AES)
│   └── PMF (802.11w) required
├── Network Segmentation
│   ├── Corporate VLAN (802.1X authenticated)
│   ├── Guest VLAN (captive portal, isolated)
│   ├── IoT VLAN (device certificates)
│   └── Management VLAN (AP administration)
├── Access Control
│   ├── RADIUS-assigned VLAN
│   ├── Dynamic ACLs per user/role
│   ├── Client isolation on guest
│   └── MAC-based auth for IoT fallback
└── Monitoring
    ├── WIDS/WIPS integration
    ├── RADIUS accounting logs
    └── AP event logging to SIEM
```

### 802.1X Configuration Audit

```bash
# Test EAP-PEAP authentication
wpa_supplicant -i wlan0 -c /tmp/peap.conf -D nl80211

# /tmp/peap.conf
cat > /tmp/peap.conf << EOF
network={
  ssid="CorpWiFi"
  key_mgmt=WPA-EAP
  eap=PEAP
  identity="testuser"
  password="testpass"
  phase2="auth=MSCHAPV2"
  ca_cert="/etc/ssl/certs/radius-ca.pem"
}
EOF

# Test for EAP downgrade — try weaker EAP methods
# If server accepts EAP-MD5 or EAP-GTC, that is a finding

# Check RADIUS server certificate
openssl s_client -connect radius.corp.local:2083 -showcerts
```

### Guest Network Isolation

```bash
# From guest network, test access to corporate resources
# Should be denied by VLAN ACLs / firewall rules
nmap -sn 10.0.0.0/24     # Corporate subnet — should timeout
nmap -sn 10.0.100.0/24   # Guest subnet — should see only gateway

# Test client isolation
# From guest client A, try to reach guest client B
ping $GUEST_CLIENT_B_IP   # Should be blocked by AP client isolation

# Test DNS filtering on guest
nslookup internal.corp.local   # Should fail or return NXDOMAIN
```

### AP Hardening Checklist

```
AP Configuration Audit Points:
├── Management interface not on user VLAN
├── HTTPS-only management (no HTTP/Telnet)
├── Default credentials changed
├── Firmware current (CVE check)
├── SNMP v3 or disabled (no v1/v2c)
├── Unused radios/bands disabled
├── Rogue AP detection enabled
├── Client isolation on guest SSIDs
├── Band steering configured
└── Rate limiting on guest networks
```

## Workflow

### Step 1: Architecture Review

Review network diagram, VLAN design, RADIUS configuration, and AP management console.

### Step 2: 802.1X Testing

```bash
wpa_supplicant -i wlan0 -c peap.conf -D nl80211
# Test EAP method negotiation, certificate validation
```

### Step 3: Segmentation Validation

Test guest-to-corporate isolation, client isolation, and VLAN enforcement.

### Step 4: AP Configuration Audit

Review each AP model against CIS Wireless Benchmark hardening requirements.

### Step 5: Encryption Audit

Verify WPA2-Enterprise minimum with CCMP, PMF enabled, no TKIP fallback.

### Step 6: Compliance Report

Map all findings to CIS Controls, NIST SP 800-153, and organizational policy.

## Detection

```yaml
title: Auditing Enterprise Wireless Security Detection
id: 07fb0a6f-b55c-4c0e-9671-47a30647cdfd
status: experimental
description: Detects suspicious activity related to auditing enterprise wireless security techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1200
  - attack.t1040
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Enterprise Wireless Security Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1200, T1040 |

## Verification

- [ ] 802.1X/RADIUS authentication tested and validated
- [ ] EAP method security confirmed (no downgrade possible)
- [ ] RADIUS server certificate pinned and valid
- [ ] Guest network fully isolated from corporate
- [ ] Client isolation enabled on guest SSIDs
- [ ] AP firmware current, default credentials changed
- [ ] Management interfaces on dedicated VLAN
- [ ] WIDS/WIPS active and alerting
- [ ] Compliance report generated against applicable framework

## References

- CIS Benchmark for Wireless Networks
- NIST SP 800-153: Guidelines for Securing WLANs
- NIST SP 800-97: Establishing Robust Security Networks (RSN/802.11i)
- PCI DSS Requirement 1.2.3, 4.1.1: Wireless Security
