How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

Question

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students;

It used to use EAP, allowing students to enter their academic credentials once in their native Wi-Fi client. Now the network is open, with a redirect to a secure browser page that authenticates credentials.

I am meeting with the vice chancellor of my college in two weeks and want to make sure my case to encrypt the student network again is solid. Trying to explain the difference between authentication and encryption to somebody with no technical knowledge is enough of a pain;

beyond explaining that the network is, in fact, open, I have to convince them that an open network is a significant risk, especially given the high volume and low technical literacy of the student body (it's a large community college).

Finally, the IT admins have claimed that the basis for switching was device compatibility -- that they could no longer support all student devices on the network.

Given that the staff still has an encrypted network, and likely uses the same variety of devices as the students, I suspect this is an excuse. Certainly on the front end EAP is a pretty well established standards. I have no clue what things look like on the back end, though.

EDIT: I have no "threat model", and I am not asking about some idealized form of security. Please understand the context of my question and answer in a manner relevant to that context. I need an reasonably actionable IT policy to advocate for, and I need to be able to present some concept of risk vs cost to the Vice Chancellor.

Is there any merit to what IT has been claiming? And am I right to be agitating for encryption for the student body?

Answer 1

I think you are worrying about the wrong thing. You should have no reason to trust the local network any more than you would for any data you'd send over the public internet. If you want to send a password, it's your responsibility to ensure you're using a connection protected by TLS. Trusting the local WiFi to protect your data is essentially excluding only the hackers within eyesight, and thinking that somehow keeps you safe.

You are responsible for your security on your own machine, and any network connections you make.

Answer 2

First, a comment; sometimes (read "almost always") I get a cool new toy, app, technology and I try to fit it in in every possible place. Even in places that don't work, I enjoy figuring out why. It's a learning experience.

The term "Threat Model" may sound either overly theoretical, or dismissive of your case. The purpose is for the security consultant to give you a proper solution.

In this case, it doesn't sound like you want a proper solution to protect against a security hole, but you see an intuitive feature (wifi encryption) that should be turned on because it "seems better". I would agree. You're doing proper due diligence coming here and asking for support. Good thought, but this audience is now mostly security consultants who want to fix a problem.

What does enabling encryption for wifi give you? It gives the students privacy for any non-SSL website. Anytime a student uses a website without SSL, you can assume that a nosy visitor, consultant, or nearby person can read that information (google searches, social media, etc). This can be the basis for your argument.

In support of your IT Staff, supporting end user devices is difficult, especially considering the multitude of devices out there. If you're a community college, chances are you're dealing with old hand me down equipment, and demanding students.

In an era where colleges have to cater (too much so) to students for revenue, I would suspect your IT staff has a compelling argument. Perhaps you can have a "middle ground" where the access point serves "WPA-2 Enterprise (iOS)" or WPA in addition to no authentication. Then you can recommend something for the security conscious users, and still have a catch-all service for students with bad hardware.

user10008 suggests telling the students to use the existing,encrypted faculty one. Assuming the faculty Wifi contains confidential / PII data, I would discourage this. It opens the door for many attacks against professors on the same connection.

Answer 3

Having once worked at an edu, it was our goal to make things as seamless and painless for the clients (students) of the University. As a professional, there were many things that we championed for especially when it came to security. For example, we opposed P2P network, because traffic patterns at the time pointed to students downloading music (back then Napster was in fashion). We opposed it because it saturated the network for others, but it also led to cesspools of viruses and infections (malware) that further disrupted the network. We put forth a proposal that was challenged tooth and nail by the clients (students), which ultimately led to P2P being allowed, but NAC being thrown up so we could babysit our clients (students) and play their personal "computer clean up crew."

The answer they gave you, was likely spot on. Clients (students - notice the repeat of this term - Clients - because at the end of the day, they pay the bills with their tuition) are all going to have a smorsgasbord of devices. There are likely clients (people who are paying a bill via tuition) who have devices that have devices that don't play well with EAP. Some students may have barebones older machines that support the ultimate barebones basic protocols. What do you do, tell those paying clients: "you need to pay more to connect, by purchasing a new laptop/phone/iPad/tablet?

Your concerned via an "open" network versus a "closed" one is kind of lopsided. How do you know that once you authenticate, you're not sending data via say a proxied network (sslvpn or so). It's like saying: "When I go to check into a hotel, I can't believe I am having to log in via an open network."

Answer 4

As the traffic leaves the university it sets on a long long journey across the globe until it reaches the server it was meant for. During that it passes lots of countries and uses lots of people's datacenters. They all can spy on you. You need strong end-to-end (TLS) protection to be safe from those people. With encrypted WiFi you can protect from others around, but if you already have stronger protection in-place, you are already protected by that.

However, the world isn't as shiny as it seems. Non-technical people can set up their private printers, public shares, or they can ignore certificate warnings. If the WiFi is encrypted, staff can manage these issues. If the WiFi is unencrypted, the students themselves have to avoid such mistakes.

Its nice to have good encryption on the first step, but not neccessary.

You have mentioned that staff still gets encrypted WiFi. A good option would be to allow Students to use that, too. If there are problems with devices on the encrypted network, staff can point to the unencrypted alternative.