Securing an Inherently Open Medium — Encryption, WPA3, and Defense From the RF Layer Up

A wired network has a cable to tap or a switch port to plug into — a physical boundary that's itself a layer of security. Radio has no equivalent: a transmitted signal radiates in every direction the antenna pattern allows, and anyone with a receiver in range can capture it. This module builds wireless security from that single fact upward, starting with why authentication and encryption solve two different problems, why AES key distribution is the hard engineering problem underneath both, and why forward secrecy — a fresh session key that can't be reconstructed even if the long-term secret later leaks — is the concept that separates a genuinely secure design from one that only looks secure. From there it covers WPA3's SAE handshake in depth (why it kills offline dictionary attacks against a captured 4-way handshake the way WPA2 never could), Wi-Fi Enhanced Open's OWE encryption for password-free networks, and the specific hardening constrained IoT and embedded devices need — default credentials, network segmentation, secure boot, and lightweight crypto sized for battery-powered hardware.

The second half turns to active threats and the infrastructure that defends against them: RF jamming as a physical-layer denial-of-service attack that no amount of encryption can stop (and the federal law — 47 U.S.C. § 333 — that makes it a crime regardless of intent), rogue access points and deauthentication attacks that exploit unprotected management frames, replay attacks and the weak security of MAC filtering, and the layered network hardening — segmentation, WIPS monitoring, physical infrastructure security, and firmware patch management — that ties it all together. The throughline is that wireless security has to be designed in from the RF layer up rather than bolted onto a finished system, a habit Module 15's troubleshooting material returns to directly when distinguishing an ordinary RF problem from an active security incident.