NetSec Wi-Fi Security Basics

Wi-Fi connects devices without physical cables by transmitting radio waves. Those same radio waves travel through walls, floors, and out into the street — anyone within range can technically receive them. Wi-Fi security protocols prevent that radio traffic from being readable by unauthorized receivers. Without security, a Wi-Fi network is like having a conversation in a crowded room: everyone can hear you.

How Wi-Fi Transmission Creates Risk

Cable Network:                Wi-Fi Network:
[PC]──cable──[Switch]         [PC]~~waves~~[Router]
                                           ~~waves broadcast in all directions~~
No signal outside the cable.               ~~reach the parking lot~~
Attacker must physically                   ~~reach the floor above~~
plug into a cable.             Attacker just needs to be nearby.

Evolution of Wi-Fi Security Protocols

WEP — Wired Equivalent Privacy (1997)

WEP was the first Wi-Fi security standard. It aimed to give wireless networks the same privacy as wired cables. It failed completely. The encryption design had fundamental mathematical weaknesses. An attacker captures enough packets and cracks WEP in under five minutes with freely available tools. WEP is completely broken and should never be used.

WPA — Wi-Fi Protected Access (2003)

WPA replaced WEP using TKIP (Temporal Key Integrity Protocol). It improved on WEP significantly but still used WEP's underlying RC4 cipher with temporary fixes layered on top. WPA is also considered insecure today and should be disabled on any modern network.

WPA2 (2004)

WPA2 introduced AES encryption, replacing RC4 entirely. This was a major leap in security. WPA2 remains the most widely deployed Wi-Fi security standard as of today. WPA2 has one significant vulnerability — KRACK (Key Reinstallation Attack, 2017) — but patching devices addressed this issue.

WPA3 (2018)

WPA3 is the current recommended standard. It fixes WPA2's weaknesses and adds stronger protections against offline password attacks, improved encryption for open networks, and better security for IoT devices. New access points and devices support WPA3, and it is backward compatible with WPA2.

Wi-Fi Security Timeline:
1997 WEP       → BROKEN (crack in under 5 min) — DISABLE
2003 WPA       → WEAK (TKIP vulnerabilities)   — DISABLE  
2004 WPA2      → ACCEPTABLE with patches       — USE if WPA3 unavailable
2018 WPA3      → CURRENT STANDARD              — USE wherever possible

Personal vs Enterprise Wi-Fi Modes

WPA2/WPA3 Personal (PSK Mode)

Everyone uses the same pre-shared key (PSK) — the password you give to guests and employees alike. Simple to configure but carries one major weakness: if the password is compromised, all traffic can potentially be decrypted, and the password must be changed for everyone.

WPA2 Personal:
┌─────────────────────────────────────────┐
│ All devices use same password: "Abc123!"│
│ [PC] [Phone] [Laptop] [Guest]           │
│ All share one key                       │
└─────────────────────────────────────────┘

WPA2/WPA3 Enterprise (802.1X)

Each user authenticates with their own unique credentials via a RADIUS server. No shared password exists. The network grants each device a unique encryption key. If one user's credentials are stolen, only that user's access is revoked — everyone else continues normally.

WPA2/WPA3 Enterprise:
[Laptop] ──authenticates──► [RADIUS Server] ──verifies──► Active Directory
          username: alice
          password: personal
          → Alice gets unique session key (only for her session)
          → Bob gets a different unique key
          → Guest gets no key (not in the directory)

SSID Management

The SSID (Service Set Identifier) is the network name visible when you scan for Wi-Fi. Some administrators "hide" the SSID by not broadcasting it. This provides no real security — attackers use tools that detect hidden SSIDs within seconds. Better practices include using a non-identifying SSID name (not "CompanyNameCorp_HQ") and running a separate guest SSID with no access to internal resources.

Basic Wi-Fi Security Checklist

✓ Use WPA3 or WPA2 (disable WEP and WPA entirely)
✓ Use a strong, randomly generated network password (20+ characters)
✓ Change the router's default admin username and password
✓ Use WPA2/WPA3 Enterprise with RADIUS for corporate networks
✓ Segment guest Wi-Fi from internal network
✓ Disable WPS (Wi-Fi Protected Setup) — it has known PIN vulnerabilities
✓ Keep router/access point firmware updated
✓ Monitor for rogue access points on the network
✓ Use a Wi-Fi intrusion detection system in high-security environments

WPS — A Common Vulnerability to Disable

WPS (Wi-Fi Protected Setup) was designed to make connecting devices easier — press a button or enter an 8-digit PIN to connect. The PIN method has a design flaw that allows brute-force attacks to crack it in under four hours. Disable WPS on every router immediately.

WPS PIN Attack:
8-digit PIN → 10^8 possible combinations (100 million)
BUT the PIN is verified in two halves:
First 4 digits:  10^4 = 10,000 combinations
Last 3 digits:   10^3 = 1,000 combinations (last digit is checksum)

Total: 10,000 + 1,000 = 11,000 attempts to crack ANY WPS PIN.
At 1 attempt/second: cracks in under 3 hours.
→ Disable WPS on every device immediately.