Wireless and Mobile Device Security, 2nd Edition

Security Audits

A security audit follows many of the same steps as a risk assessment. The difference is that a security audit looks for proof that best practices and procedures were followed. In many cases, these audits are internal. However, the same person or team who performed the risk assessment should not carry out a security audit.

An auditor conducting a security audit for WLAN security vulnerabilities should look at the following points (in addition to those items examined on a wired network):

• The potential for unauthorized access to the WLAN
• Radio frequency (RF) leakage beyond the physical perimeter
• The use of weak encryption protocols such as WEP or WPA
• The existence of rogue access points
• If preshared keys are used, how widely the ...