mous SSID that does not identify the company or organisation operating the WLAN. After changing the default SSID, some manufacturers provide an option to disable the SSID from being broadcast in beacon frames. This will prevent the casual eavesdropper from obtaining the SSID, but will not stop the determined hacker. The SSID is included unencrypted in the Probe Response frame transmitted by an access point when responding to a Probe Request sent by a client station attempting to connect, SO a hacker equipped with "sniffer" software can extract the SSID from these messages. The SSID is not intended to perform a security function, and changing the SSID from its default and disabling SSID broadcasts will only be effective against casual unauthorised access. Stronger measures are required to guard against a targeted attack. Chapter Eight Table 8-8: WLAN Technical Security Measures Technical security measure Description Change the default SSID and disable Prevents casual access to the WLAN and SSID broadcast requires a client station to match the SSID when attempting to associate. Disable all nonessential management Each management protocol provides a protocols on access points possible route of attack, SO disabling unused protocols minimises the potential routes that an attacker could use. Ensure that default shared keys are Manual key management will be necessary replaced by keys of at least unless TKIP is installed (Section "Temporal 128-bits and periodically Key Integrity Protocol, p. 212"). Best practice change keys is to use the longest supported key length. Deploy MAC access control lists Access control based on MAC filtering provides additional security although, as described in the Section "MAC Addressing Filtering, p. 234", it is not secure against a technically determined attacker. Enable user authentication and strong Management control functions on access administrative passwords for access points need to be protected as well as, if not point management interfaces better than, the network traffic. The sec