24.8. Best Practices

• Implement the strongest form of wireless encryption available on your WAPs. Any form of encryption is better than no encryption. Even though WEP has known weaknesses, it is still better to enable WEP than to have no encryption at all if your WAP does not support WPA or WPA2. If you do implement WEP, ensure that you regularly modify the WEP key to protect against attacks against the WEP key.

• Implement only WAPs that support 802.1x authentication. 802.1x authentication decreases some of the weaknesses associated with WEP encryption. 802.1x ensures that only authenticated clients (computers and users) can connect to the wireless network, and it provides automated distribution of the encryption keys.

• Implement PEAP or EAP-TLS for authenticating all wireless clients. Both authentication methods provide strong protection of the user’s credentials. In addition, EAP-TLS and PEAP ensure that the computers or users mutually authenticate with a RADIUS server when they connect to the wireless network.

• Deploy certificates using autoenrollment or scripted enrollment for domain members. Automating the deployment of certificates ensures that all users and computers obtain the necessary certificates for wireless networking. Automated deployment reduces the chance of user error during the enrollment process.

• Use Group Policy to define Wireless Networking settings. Group Policy can ensure that computers running Windows XP or later are correctly configured when connecting to a wireless network. Group Policy eliminates user error when configuring the wireless networking connection.