How to secure your office wireless network

You secure your office wireless network in a few steps: an up-to-date router or access points with the admin password changed, WPA3 encryption (or at least WPA2 with AES), a long password, a separate network for visitors, a firewall, and remote access only through a VPN.

We wrote this article in August 2021, when researchers had announced that millions of routers used by certain manufacturers and internet providers had serious vulnerabilities. News like this comes out every year, so the office router has to be treated like any other piece of security equipment: updated regularly and replaced when the manufacturer stops providing updates.

Every infrastructure has both a “wired” network and a wireless network.

In this article, we present the most common types of attacks on wireless networks, as well as how such a network should be secured.

What types of attacks target wireless networks?

Denial of service (DoS)

Denial of service (DoS) attacks are used to bring equipment down by flooding it with traffic. Attackers send a huge number of packets to network equipment, so its resources become saturated and the equipment stops responding. In wireless networks, the attacker can also jam the signal or send fake deauthentication packets, so that devices lose their connection to the network.

The goal of such an attack is to prevent legitimate users from using the infrastructure.

Rogue access point

A rogue access point attack consists of adding an unauthorized wireless device to the network in order to intercept your traffic. Hackers use this kind of device to steal users’ sensitive data and to attack equipment inside the network.

Evil twin

The attacker creates a wireless network with the same name as the office network (or that of a café or a hotel), and devices connect to it without users noticing. All the traffic then passes through the attacker’s equipment.

Passive capturing

In a passive attack, attackers listen to nearby wireless traffic without interacting with the network and save it for analysis. If the network uses old encryption (WEP, or WPA with TKIP) or a short password, the password can be cracked later.

Once inside the network, attackers monitor and scan the equipment to identify vulnerabilities. If they find a vulnerable device, the hackers take control of it and use it both to intercept data and to try to access network resources from the inside.

IT services for companies: tell me more →

How do you secure your office wireless network?

Now that we know the most common attacks, below we explain how to secure your wireless network to keep hackers at bay.

Secure the router

It’s absolutely crucial to secure the router and the access points, because a device with default security settings is very vulnerable.

What exactly do you need to do?

• Change the default network name (SSID), which can reveal the router model.
• Change the router’s default admin password.
• Install the available firmware updates, and replace the device when the manufacturer stops providing updates.
• Turn off remote management and the WPS feature (connecting with a button or a PIN), which can be cracked easily.

Use strong encryption, such as WPA3

To keep your wireless traffic from being intercepted from outside the network, use the WPA3 encryption protocol. You turn it on in the router when you create the wireless network and choose its name and password. WPA3 also makes protection against fake deauthentication packets mandatory.

If some older devices don’t support WPA3, use WPA2/WPA3 mixed mode or WPA2 with AES, never WEP or WPA with TKIP.

In companies with several employees, Enterprise mode (WPA3-Enterprise or WPA2-Enterprise, with 802.1X authentication) gives each employee their own login credentials. When someone leaves the company, you close their account without changing the network password for everyone else.

Set a complex password for the wireless network

To head off attacks, you need to set a password with a high level of security. We recommend a password of at least 20 characters, containing uppercase and lowercase letters, numbers and symbols. Change the password whenever someone who knew it leaves the company.

Restrict network access for devices that aren’t yours

Another security measure is restricting network access for devices that don’t belong to you, by adding only your own devices to the list of allowed devices (MAC address filtering).

MAC address filtering is weak protection, though: a MAC address can be copied easily, and new phones and more and more laptops use random MAC addresses by default, different for each network. Enterprise mode, with authentication for each user or device, is much more secure.

Create a separate network for visitors

Visitors, employees’ personal phones and smart devices (TVs, cameras, printers) should sit on a separate network, isolated from the company’s computers and servers. Most business routers and access points have this option.

Use firewall devices

A hardware firewall adds an extra layer of security that helps protect the network. The firewall rejects malicious traffic and blocks access to websites of dubious quality. See also the difference between a router, a firewall and a UTM.

Access the office network through a VPN connection

Restricting remote access is a very effective way to secure your infrastructure. To make remote work easier, we recommend creating VPN connections for users, with two-step verification. You’ll find more in the article on why your company needs a high-performance VPN solution.

If the problem is the signal rather than security, see common problems and fixes for Wi-Fi networks. For your home network, you’ll find tips in the article on how we secure the wireless network at the office or at home.

Backup as a Service: tell me more →

RezolvIT is an IT outsourcing company that successfully supports its clients, whether we’re talking about securing their infrastructure or employees working from home. Office networks, wired or wireless, are part of our IT infrastructure services.