How to secure your wireless network at the office or at home

Learn about the most common attacks on wireless networks, and about how such a network should be secured.

Types of attacks

Denial-of-service (DoS):

DoS attacks are used to take devices down by flooding them with traffic. Attackers send huge numbers of packets to network devices, so their resources become saturated and the devices stop responding.

The goal of such an attack is to prevent legitimate users from using the infrastructure.

Rogue access point:

This attack consists of adding a malicious wireless device to the network in order to intercept your traffic. Hackers use this kind of device to steal users’ sensitive data and to attack devices inside the network.

A common variant is the “evil twin”: a fake network with the same name as the company’s network or a café’s, which phones and laptops may connect to automatically.

Passive capturing:

Attackers monitor and scan the devices on the network to identify vulnerabilities. If they find a vulnerable device, hackers take control of it and use it both to intercept data and to try to access network resources from the inside.

The data exchanged when a device connects to a WPA2 network with a shared password can also be captured passively; the attacker then tries to crack it on their own computer, without needing to stay within range of the network. That’s why password length matters so much.

How to secure the office wireless network

Now that we know the most common types of attacks, we’ll explain below how the wireless network should be secured to keep hackers away.

Secure the router:

It’s absolutely crucial to secure the router, because a device with default security settings is very vulnerable.

What exactly should you do?

• Change the router’s name.
• Change the router’s default admin password.
• Install the available security updates.
• Disable remote access features.
• Disable WPS (connecting with a button or a PIN code), which can be used to bypass the network password.

If the manufacturer no longer publishes updates for the router, the device has reached the end of its life cycle and must be replaced. You’ll find details about the risks in the article on end-of-life (EOL) technologies.

Use strong encryption, such as WPA3:

So that wireless traffic can’t be intercepted from outside the network, we recommend using the WPA3 encryption protocol. You turn it on in the router when you create the wireless network and choose its name and password.

If some older devices can’t connect over WPA3, use WPA2/WPA3 mixed mode until you replace them, but don’t go back to WEP or the first version of WPA, which have long been considered insecure. The 6 GHz band, used by Wi-Fi 6E and Wi-Fi 7 equipment, works only with WPA3.

Set a complex password for the wireless network:

To head off attacks, you need to set a password with a high level of security. We recommend a password of at least 20 characters, containing uppercase and lowercase letters, numbers and symbols.

Change the password when an employee who knew it leaves the company. In a company, the safer option is WPA3-Enterprise (or WPA2-Enterprise), where each employee connects with their own account: when someone leaves, you close their account without changing the password for everyone.

Restrict network access for devices that don’t belong to you:

Another easy-to-implement security measure is restricting network access for devices that don’t belong to you. You do this by adding only your own devices to the list of allowed devices.

MAC address filtering is still an extra barrier, though, not basic protection: MAC addresses can be copied, and new phones and laptops use a random MAC address for each network by default, so the list needs updating. For visitors, create a separate guest network, isolated from the company network.

Use firewall devices:

A hardware firewall adds an extra layer of security that helps secure the network. It rejects malicious traffic and blocks access to websites of dubious quality.

The difference between these devices is explained in the article on routers, firewalls and UTMs.

Access the office network through a VPN connection:

Restricting remote access is a very effective way to secure the infrastructure. To make remote work possible, we recommend setting up VPN connections for users. Also, if the router allows it, choose a VPN solution that encrypts traffic.

Protect the VPN connection with two-step verification and keep the device that provides it up to date: in recent years, many attacks on companies started from unpatched VPN devices.

What else does a company’s wireless network need?

Besides the steps above, a company wireless network needs separate networks, individual accounts and equipment that still receives updates.

• Separate networks. One for employees, one for guests and, ideally, one for printers, security cameras and other “smart” devices, which rarely get updates. The guest network has no access to the company’s servers and computers.
• Individual accounts. With WPA3-Enterprise or WPA2-Enterprise, each employee has their own login details, and access ends when the account is closed.
• Updated equipment. Routers and access points that no longer receive updates from the manufacturer get replaced.
• Monitoring. A system that alerts you when an unknown device or a foreign access point (rogue access point) appears on the network.

How do you protect yourself when working from home or on a public network?

Treat any network outside the office as untrusted and connect to company resources only through a VPN.

• At home, apply the same steps as at the office: change the router admin password, install updates, use WPA3 or WPA2 and disable WPS.
• In cafés, hotels and airports, check the exact network name and avoid open networks with generic names. Your phone’s hotspot is often the safer option.
• Work laptops need their own measures too: disk encryption, automatic updates and antivirus. You’ll find them in the article on mandatory security measures for work laptops used at home.

RezolvIT is an IT outsourcing company that successfully supports the companies it works with, whether that means securing their infrastructure or enabling their employees to work remotely. See our IT outsourcing and IT security services, or ask for a free IT audit.