Network Security / Wireless
Wireless Network Security
A wireless LAN (WLAN) extends the network boundary into radio range. Link protection can authenticate a station and protect frames over the air, but it does not establish application authorization, endpoint health, safe upstream routing, or trust in every device sharing the service set.
Identify the wireless trust path
- A station/supplicant is the client seeking network access.
- An access point (AP)/authenticator controls the wireless link and relays enterprise authentication where configured.
- An authentication server such as RADIUS evaluates an 802.1X/EAP exchange and returns authorization attributes.
- A wireless controller or management plane configures APs, radio policy, identities, segmentation, and telemetry.
- The distribution network carries traffic from the AP to upstream enforcement. Encryption over the radio link may terminate at the AP; later paths need their own protection.
The Service Set Identifier (SSID) is a network name, not an authenticated identity. A station must authenticate the real network through the chosen WPA/EAP method and correctly validate any server certificate; otherwise an evil-twin AP can imitate the name.
Choose personal or enterprise authentication deliberately
| Mode | Credential and identity model | Main boundary |
|---|---|---|
| WPA3-Personal (SAE) | A shared passphrase participates in Simultaneous Authentication of Equals; each successful association derives session keys. | SAE improves resistance to passive offline password guessing compared with the WPA2-Personal PSK handshake, but a shared human password still has distribution, strength, insider, and retirement problems. |
| WPA2-Personal (PSK) | One shared secret normally authorizes all devices on the SSID. | A captured handshake can support offline guesses against a weak passphrase; changing one compromised shared secret disrupts every device. Use only where WPA3 and per-device credentials are unavailable and compensate with isolation and migration. |
| WPA2/WPA3-Enterprise with 802.1X/EAP | Individual or device credentials are evaluated through an EAP method and AAA policy. | Security depends on the exact EAP method, supplicant configuration, authentication-server validation, certificate lifecycle, and authorization attributes—not on the word “Enterprise” alone. |
Prefer a mutually authenticating, key-deriving EAP method appropriate to the environment. With EAP-TLS, provision client credentials and configure clients to validate the expected authentication-server name and trust chain. EAP defines a framework; different EAP methods make different security claims.
WPA3 requires Protected Management Frames (PMF) in certified WPA3 networks, which protects selected management frames after key establishment. It does not encrypt all management traffic, prevent radio jamming, authenticate unaffiliated beacons before association, or eliminate implementation defects.
Segment wireless clients by purpose and identity
- Put workforce, privileged administration, guest, IoT, operational technology, and unmanaged devices in separate policy domains according to risk and required reachability.
- Guest isolation should restrict guest-to-internal and usually guest-to-guest communication, while preserving required DNS, DHCP, captive-portal, and internet paths.
- Dynamic VLAN or role assignment from AAA can reduce SSID sprawl, but the returned attributes, controller mapping, and fallback behavior must be tested.
- A captive portal records acceptance or identity for a web flow; it is not a substitute for robust link authentication or downstream authorization.
- Disable dual-homing or bridge behavior where a managed device must not connect protected and untrusted networks simultaneously.
Detect radio and management-plane threats
Inventory approved AP radios, Basic Service Set Identifiers (BSSIDs), channels, locations, firmware, certificates, switch ports, controller relationships, and owners. Monitor for rogue and evil-twin APs, unauthorized ad hoc networks, unexpected security downgrades, deauthentication/disassociation anomalies, repeated authentication failure, impossible movement, weak signal areas that encourage unsafe alternatives, and AP/controller configuration drift.
Wireless intrusion detection can locate suspicious radio behavior, but classification requires care: a neighboring SSID is not automatically rogue, and an attacker can spoof identifiers. Confirm wired attachment, ownership, location, and traffic before containment.
Test lifecycle, failure, and recovery
- Validate advertised and negotiated authentication/cipher modes with representative clients; do not infer negotiated WPA3 solely from the SSID configuration.
- Test server-certificate failure, expired client credentials, revoked devices, AAA outage, controller failover, AP isolation, and policy fallback.
- Verify client isolation and upstream segmentation from actual wireless stations, including IPv6 and peer-to-peer paths.
- Measure coverage, interference, retries, authentication latency, roaming, DHCP/DNS behavior, AP capacity, and telemetry loss under representative load.
- Rotate shared secrets and certificates through a staged process. Remove retired trust roots, profiles, SSIDs, APs, and AAA rules after clients migrate.
Define fail behavior for unavailable AAA or controller services. Cached authorization can preserve availability but extend removed access; fail-closed behavior can strand users and administrators. Keep a monitored recovery network or wired management path that does not become a routine bypass.
Retire unsafe configurations
- Do not use open networks, WEP, WPA/TKIP, or Wi-Fi Protected Setup (WPS) PIN as protection for trusted access.
- Avoid WPA2/WPA3 transition mode longer than compatibility requires. It retains a WPA2 path for legacy clients and therefore does not give every association WPA3 properties.
- Replace shared workforce PSKs with individual enterprise credentials where lifecycle and attribution justify the added infrastructure.
- Remove obsolete SSIDs and trust profiles from both infrastructure and clients so devices do not automatically reconnect to an attacker-controlled imitation.
Wireless security protects a radio link within a larger identity, endpoint, and network-policy system. Validate the negotiated mode and authentication server, separate device classes, monitor both radio and management planes, and test credential, AAA, controller, and migration failure.
Primary references
- NIST SP 800-153: Guidelines for Securing Wireless Local Area Networks — verified WLAN components, standardized configurations, monitoring, dual-connected clients, assessment, and lifecycle management.
- RFC 3748: Extensible Authentication Protocol — verified EAP actors, method-specific security claims, mutual authentication, key derivation, negotiation, and lower-layer dependencies.
- Wi-Fi Alliance: Wi-Fi CERTIFIED WPA3 security announcement — verified WPA3-Personal SAE, WPA3-Enterprise profiles, and PMF certification requirements.