This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Rogue AP Detection Question

When a rogue AP is detected, what does sophos actually do? Does it just mark it as Rogue or does it take additional steps to help alert/remediate the issue?

This thread was automatically locked due to age.

Parents

0 Badrobot over 5 years ago

That is a good question, most I could find was https://docs.sophos.com/nsg/sophos-firewall/v17.1.4/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/RogueAPScanning.html

Respectfully,

Badrobot
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Badrobot

This is the correct online help link.

https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/WirelessDashboard.html?hl=rogue

Basically we only show the Rogue APs but do not perform any actions (right now).

As far as i know, there are couple of law issues with taking automatic remediation actions.

I am not a legal expert, but feel free to read this : http://transition.fcc.gov/Daily_Releases/Daily_Business/2015/db1102/FCC-15-146A1.pdf

The technical way to mitigate a rogue ap is something like:

https://en.wikipedia.org/wiki/Wi-Fi_deauthentication_attack

Maybe Tejas Kashyap can give more insight on this? :)

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 5 years ago in reply to Badrobot

This is the correct online help link.

https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/WirelessDashboard.html?hl=rogue

Basically we only show the Rogue APs but do not perform any actions (right now).

As far as i know, there are couple of law issues with taking automatic remediation actions.

I am not a legal expert, but feel free to read this : http://transition.fcc.gov/Daily_Releases/Daily_Business/2015/db1102/FCC-15-146A1.pdf

The technical way to mitigate a rogue ap is something like:

https://en.wikipedia.org/wiki/Wi-Fi_deauthentication_attack

Maybe Tejas Kashyap can give more insight on this? :)

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Children

+2 Tejas Kashyap over 5 years ago in reply to LuCar Toni

Agree. As of now, we are scanning the neighborhood for networks and just classify them. The solution we have is just intrusion detection and not prevention. WIPS in itself is plagued with a lot of issues, right from the legality as has been mentioned above to the effectiveness of the solution. Normally WIPS consists of APs having 3 radios with one acting as a sensor. There are solutions where the same radio serves the clients and acts as a sensor by timesharing.

To summarize, we do not have any actions that can be performed once rogue APs are identified.
Cancel
Vote Up 0 Vote Down

Cancel