How to secure corporate Wi-Fi and what fails most often on tests

We start with the setup we see most often: one password the whole company knows. Technically that is WPA2-PSK or WPA3-Personal, a network protected by a single shared password (PSK). The problem is not the strength of that password. It is that too many people know it and it never changes.

A shared password travels outside the company easily. It is on a slip of paper in a drawer, in a former employee’s phone, on a visitor card someone photographed. Changing it means going around every device in the company, so it gets postponed, and the password survives years and staff turnover. Anyone who gets hold of it connects until it changes.

The way out is not to share it. The enterprise variant 802.1X, that is, authentication against an account on a RADIUS server (WPA2 or WPA3-Enterprise), gives every user their own login instead of one password for everyone. Someone leaves, their account goes away, and nobody else has to change anything. On a small network the minimum is changing the shared password regularly and giving guests separate access.

The second mistake we run into is that the guest and the corporate Wi-Fi are in effect one network. A guest connects for internet access during a meeting, but their device also sees the printers, the shared drives, and internal applications, because there is no boundary between guests and company systems.

Without separation, the guest network becomes an entry into the internal network. A visitor connects, a supplier, anyone within range who knows the guest password, and they end up in the same segment as the servers. What sits behind the Wi-Fi in the internal network is then within reach, and that is what the wired network and Active Directory test covers.

Separation is done by segmentation: the guest network in its own VLAN with access only to the internet, not to internal resources, and a firewall between the segments that keeps guest traffic from coming inside. The same boundary belongs between the corporate Wi-Fi and sensitive systems, so one cracked password doesn’t open the whole network at once.

The third category doesn’t abuse the password but the trust of the device. An evil twin is a fake access point carrying the name of your network, and a phone or a laptop connects to it on its own, because it knows the name from before. The attacker only has to be within range and pretend to be your Wi-Fi.

To push the victim onto their own access point, the attacker drops the connection to the real one with deauthentication, a frame that disconnects the device, which then joins the stronger signal the attacker is offering. On a WPA3 network this may not work: WPA3 enforces management frame protection, which blocks deauthentication. That is exactly why resistance to being pushed onto a rogue access point is one of the things a test tries out rather than assumes.

Once the victim connects to the rogue access point, the attacker sees their traffic and can slip them a login page of their own. In companies with a shared password, an evil twin is enough to get people to type the password into a fake portal. With 802.1X the target is different: if the client doesn’t verify the server certificate, the attacker poses as the network and collects credential material from the authentication attempt.

The fourth category is easy to miss: the network looks protected and still has a hole. One case is 802.1X where the client doesn’t verify the server certificate. Enterprise authentication then does run, but the device also logs in to the attacker’s RADIUS server posing as the network, and hands it material for cracking the password.

The second weakness is outdated encryption and a shared password on WPA2. With WPA2-PSK the handshake can be captured when a client connects, and on some access points the PMKID can be taken straight from the access point without waiting for a client. The password is then cracked offline, off the network, where no attempt limit slows the attacker down. A long random password helps against that, or a move to WPA3 and 802.1X.

Watch out for WPA3 in transition mode as well. To keep older devices working, the network runs WPA2 alongside WPA3 with the same password, and the attacker then stands up a fake access point offering only WPA2 and pulls the victim down to it. The network looks like WPA3 and inherits the weaknesses of WPA2. Offline cracking of the handshake and the PMKID is a WPA2 matter: against WPA3 with its own authentication (SAE) the method doesn’t work, and that is the reason to move the whole network to WPA3 rather than add it alongside.

Remediation follows those four mistakes, not a general list. Replace the password shared by the whole company with 802.1X, where each person has a login of their own. Where that can’t happen right away, at least separate the guests and change the password regularly. Put the guest network in its own VLAN with access only to the internet. Require the device to verify the server certificate on 802.1X, so it won’t connect to a rogue access point. And move the whole network to WPA3 instead of running it in transition mode next to WPA2.

Along with that, watch whether an access point with your network name shows up nearby, because a rogue access point and an evil twin can be caught by monitoring. Most of this is about configuration, not about buying new hardware, and it can be checked against a real attack.

If you want to know what really gets through from around the building, it pays to have the Wi-Fi tested from the position of someone within range of the signal. Wireless doesn’t have to be the target either. It can be the way in: where Wi-Fi as initial access leads once the attacker is inside is the subject of a separate article on ransomware.

With a shared password it isn’t, however complex it is. A strong password makes cracking harder, but its weakness isn’t strength. It is that the whole company knows it, it never changes, and it travels outside. Anyone who gets hold of it connects. A corporate network belongs on 802.1X, where each person has a login of their own and someone leaving is handled by deleting an account, not by changing the password on every device.

WPA3 is a step forward from WPA2: it has more resistant authentication, where the password can’t be cracked offline from a captured handshake, and it enforces management frame protection against deauthentication. What matters, though, is the configuration. WPA3 in transition mode leaves WPA2 running alongside it with the same password, and inherits its weaknesses that way. WPA3 is safe when it runs on its own, not as an add-on to WPA2.

Yes. The guest network belongs in its own segment with access only to the internet, not to printers, shared drives, and internal applications. Without separation, a guest becomes an entry into the internal network: anyone within range who knows the guest password connects and is in the same segment as the servers. Segmentation through VLANs and a firewall between the segments is the minimum, not a luxury.