NexusSec.Office Wi-Fi is often set up once, on the day the access points arrive, with a password that is still the same years later and known to every former employee and visitor who ever asked for it. Deciding how people should connect is a small decision with long consequences.
The two ways to authenticate
| Option | How people connect | Fits when |
|---|---|---|
| WPA3-Personal (shared key) | One password for everyone on that network | Small offices, and networks for devices that cannot do per-user sign-in |
| WPA3-Enterprise (802.1X) | Each person signs in with their own account or certificate, checked by a RADIUS server | Offices where people join and leave regularly, or where you need to know who is connected |
WPA3-Personal replaces WPA2's handshake with one called SAE, which makes it much harder to guess the password from captured traffic. WPA3 also requires protected management frames, which blocks some attacks that knock devices off the network. If some older devices only support WPA2, a transition mode can run both, at the cost of the older protection for those devices.
When a shared password is enough
- The office is small and the people using it change rarely.
- The password is long and not guessable, not the company name and the year.
- It is changed whenever someone with access leaves. If that feels like too much work, that is the sign you need 802.1X.
- The network behind it is segmented, so knowing the Wi-Fi password does not reach everything. See one laptop should not reach everything.
When per-user sign-in is worth it
With 802.1X, each person signs in with their own credentials, often their normal work account, or with a certificate installed on a managed device. When someone leaves, disabling their account removes their Wi-Fi access too, and the logs show who was connected. It needs a RADIUS server, which many firewalls, directory services and cloud Wi-Fi platforms provide, and a little more setup on devices. For most offices of more than a handful of people, it pays for itself the first time someone leaves on bad terms.
Settings that matter whichever you choose
- Turn off WPS. The push-button and PIN setup feature is a known weakness and is not needed on a managed network.
- Separate networks for guests and devices. Visitors and IoT devices such as cameras and printers belong on their own SSIDs and VLANs. See guest Wi-Fi, cameras and printers.
- Change default admin passwords on access points and controllers, and keep their management interfaces off the staff network.
- Update firmware. Access points are network devices with their own vulnerabilities; include them in your patching routine.
- Look for rogue access points. Business access points can often report unknown networks broadcasting nearby, including someone's personal hotspot bridged into the office.
For a test of how your wireless network holds up, see our wireless penetration testing service.
