Wi-Fi is as fundamental infrastructure in a modern office as electricity. And yet, surprisingly little attention is paid to its security. The typical situation in many companies: one SSID for everything, a password shared with visitors, WPA2-Personal with a password that no one has changed since installation. This approach is unacceptable today.
Wi-Fi security audit, which SecureOn.cz performs and reveals at least one critical vulnerability in the wireless network in 80% of cases. Most common findings: shared network for employees and guests, missing 802.1X authentication, unprotected management frames or undetected rogue access points.
Wireless network segmentation: The foundation of proper architecture
Every corporate Wi-Fi infrastructure should have at least three separate SSIDs, each on its own VLAN with the relevant firewall rules:
Corporate SSID (Corporate)
Exclusively for business equipment. Access authenticated via 802.1X/RADIUS based on device identity (certificate) or user credentials (domain login details). This network has full access to internal systems.
- Protocol: WPA3-Enterprise or WPA2-Enterprise (transition to WPA3 where possible).
- Authentication: 802.1X with EAP-TLS (certificates) or PEAP-MSCHAPv2 (domain credentials).
- Only devices complying with the security policy (NAC check: patch status, EDR installed).
Hostovská Guest SSID
For visitors, suppliers and employees' personal devices. Internet access only; all communication with the internal network is blocked. Guest portal (captive portal) for registration with time-limited access.
- Protocol: WPA3-Personal or WPA2-Personal with password rotation (at least monthly).
- Client-to-client communication (AP isolation) is disabled: guests cannot attack each other.
- Rate limiting: bandwidth limitation per user.
- DNS filtering: blocking harmful domains even on the guest network.
IoT SSID
For smart TVs, printers, IP cameras, air conditioners and other Internet of Things devices. These devices typically have outdated firmware and poor security. They must be strictly isolated.
- Access only to essential internal systems (e.g., a printer to a print server); everything else is blocked.
- AP isolation mandatory: IoT devices must not communicate with each other.
- Anomaly monitoring: any attempt to communicate outside the permitted scope triggers an alert.
WPA3 vs. WPA2: Why the transition matters
WPA2 with a pre-shared key (PSK) has a critical weakness: offline brute-force attacks. An attacker captures the 4-way handshake during client connection and subsequently cracks the password offline without any contact with the network. Modern GPUs can test billions of combinations per second. Short or dictionary-based passwords are vulnerable to being cracked.
WPA3-Personal addresses this issue with the SAE protocol (Simultaneous Authentication of Equals, also known as Dragonfly). SAE prevents offline brute-force attacks, every login attempt requires interaction with the network. Additionally, WPA3 provides Forward Secrecy. Even if an attacker intercepts historical traffic and cracks the password, they cannot decrypt the captured communication retrospectively.
When to use WPA2, when WPA3?
- WPA3-Enterprise is preferred for corporate networks with modern hardware (access points from 2020+).
- If you have older equipment without WPA3 support, WPA2-Enterprise with 802.1X remains a secure alternative for corporate networks.
- WPA2-Personal (PSK) is unsuitable for corporate networks: switch to WPA2-Enterprise or WPA3.
- For the guest network, WPA3-Personal or WPA2-Personal is acceptable provided other security measures are observed (AP isolation, separation).
802.1X and RADIUS: Enterprise-level authentication
802.1X is a standard for network access authentication. The client (supplicant) must authenticate against the RADIUS server before gaining network access. This is a fundamental difference compared to shared passwords: each user or device has its own identity.
Components of the 802.1X infrastructure
- Applicantclient software on devices (built-in to Windows, macOS, Linux, iOS, Android).
- Authenticatoraccess point (AP) or switch that controls access based on decisions from a RADIUS server.
- RADIUS serververifies login credentials against the directory (Active Directory, LDAP). Popular solutions: FreeRADIUS (open-source), Microsoft NPS, Cisco ISE, Aruba ClearPass.
EAP methods: which is the safest?
- EAP-TLSauthentication via client certificate. The most secure option: the password cannot be stolen because it is not used. Requires a PKI infrastructure (certificate authority).
- PEAP-MSCHAPv2domain credential authentication within a TLS tunnel. More secure than PSK but vulnerable to attacks if misconfigured (e.g., failure to validate the server certificate).
- EAP-TTLSsimilar to PEAP, supports multiple internal authentication methods.
Recommendation: for new deployments, choose EAP-TLS with PKI; for migration from PSK, PEAP-MSCHAPv2 is a good intermediate step. Always validate the RADIUS server's certificate on the client: without this, PEAP is vulnerable to evil twin attacks.
Rogue AP detection and PMF (Protected Management Frames)
Rogue access points
A rogue AP is an unauthorised access point on a network. It may be:
- An employee who brought their own router and connected it to the network (an unintentional security risk).
- Evil twin AP: an attacker sets up an access point with the same SSID as the corporate network to lure clients into connecting.
- Compromised air conditioner in the supply chain or following physical access by an attacker.
Rogue AP detection should be automated. Modern Wi-Fi controllers (Cisco Meraki, Aruba, Ruckus) monitor the radio environment and alert on unauthorised APs. Key point: detection must distinguish between neighbouring legitimate networks and actual rogue APs within your network.
PMF (Protected Management Frames)
Wi-Fi management frames (deauthentication, disassociation) are historically unencrypted and unprotected. An attacker can spoof them to disconnect clients from the network: a classic deauth attack used for DoS or forcing clients to connect to an evil twin AP.
PMF (802.11w) management frames are cryptographically protected. WPA3 requires PMF. For WPA2 networks, enable PMF in the access point configuration (minimum "optional", ideally "required" for corporate SSIDs).
Wi-Fi Security Audit Methodology
A Wi-Fi audit should include these phases:
- Passive surveyscanning of the radio environment, inventory of SSIDs, identification of protocols and encryption, detection of rogue access points.
- Active authentication testingverification of correct RADIUS certificate configuration, testing of EAP methods and client configuration.
- Testing segmentation. Verification that the guest network has no access to internal resources, AP isolation test.
- Evil Twin simulationcreation of a rogue access point and verification that the client device behaves correctly (rejects connection or displays a warning).
- Physical securitycheck access to AP management ports, physical location of AP (accessible to unauthorised persons?).
The result of the audit is a report with specific findings, their severity (CVSS score), and recommendations for remediation. SecureOn.cz conducts Wi-Fi security audits using professional tools (Aircrack-ng, Wireshark, Kismet, specialised hardware) and experienced penetration testers.
Conclusion: Wi-Fi security is not an optional add-on
A wireless network is the entry point to your company's infrastructure, physically extending beyond the building walls. Proper segmentation, strong 802.1X authentication and regular security audits are basic hygiene, not an extra. Implementing these measures is achievable for companies of all sizes and significantly reduces the risk of intrusion via the wireless network.