Business Wi-Fi Security: WPA3, Guest Networks and 802.1X

In the waiting room of a physiotherapy clinic in Pointe-Claire, the Wi-Fi password is written in marker on a whiteboard. It's the same network used by the front desk computer, the printer and the server holding patient files. The router the internet provider installed six years ago has never been updated. And three former employees still know the password.

That picture is far from rare. Wi-Fi is often the most neglected piece of equipment in a small business: it "works," so nobody touches it. Yet anyone within range of the signal, in the parking lot or the office next door, can try to get on.

The Canadian Centre for Cyber Security sets a clear baseline: WPA2 encryption or better, preferably WPA2-Enterprise, and never a link between public Wi-Fi and the corporate network. Here's how to get there without drowning in acronyms.

One network per use

The first decision isn't technical; it's organizational. Who needs to connect, and to what? The Cyber Centre recommends putting guests and smart devices on a separate access point, or even a separate internet subscription, and segmenting the devices that must stay on the corporate network, such as printers and point-of-sale terminals.

The Cyber Centre also advises keeping critical services on wired connections: a simple jammer is enough to cripple a business that relies entirely on wireless.

WPA2, WPA3, Personal, Enterprise: decoding the acronyms

These labels hide two separate questions: the protocol generation (WPA2 or WPA3) and the authentication mode (Personal or Enterprise).

A few useful details:

• WPA3 requires Protected Management Frames (PMF), according to the Wi-Fi Alliance, which makes some forced-disconnection attacks harder.
• WPA2/WPA3 transition mode lets older devices keep connecting, but it leaves the door open to the weaker protocol. Use it only while you replace those devices.
• On the 6 GHz band (Wi-Fi 6E), WPA3 is mandatory: WPA2 isn't permitted there.
• WPA3-Enterprise 192-bit mode is an option for highly sensitive environments. Most small businesses don't need it.

For Enterprise mode, the Cyber Centre considers certificate-based authentication (EAP-TLS) the most secure practice. Username-and-password options (PEAP) are easier to set up, and cloud RADIUS services can tie your Wi-Fi to the directory you already use.

The real problem with shared passwords

The Cyber Centre is blunt: it doesn't recommend a pre-shared key over Enterprise mode for any organization. The reason is simple. Once you've handed out the password, the only way to lock someone out is to change it for everyone.

Take a real estate brokerage in Kanata with 18 agents and assistants. Same Wi-Fi password for four years, known to a dozen former colleagues. Switching to Enterprise mode, tied to the brokerage's directory, fixed it: when someone leaves, their account is disabled and their Wi-Fi access goes with it.

If you must keep a shared passphrase, at least split guests, staff and smart devices onto separate networks (SSIDs) and virtual LANs (VLANs), each with its own passphrase. Aim for at least four words and 15 characters, as the Cyber Centre recommends.

Harden your access points and router

• Default network and admin passwords changed.
• WPS turned off: the Cyber Centre considers it insecure for business use.
• Firmware up to date, and devices that no longer get updates replaced.
• Admin interface unreachable from the guest network and the internet.
• A firewall between Wi-Fi and the internal network.
• Client isolation enabled on the guest network.
• Guest passphrase changed regularly, daily or weekly depending on traffic.
• An inventory of authorized access points and where they are.

If your consumer-grade router has hit its limits, our small business firewall comparison can help you pick equipment that handles multiple networks cleanly.

Rogue access points and fake networks

Two threats often go unnoticed. The first is the access point a well-meaning employee plugs in to "boost the signal" in the warehouse, with no security settings at all. The Cyber Centre notes that these unauthorized access points are often insecure. The second is the fake network that mimics your network's name to capture connections and credentials.

A wireless intrusion detection or prevention system (WIDS or WIPS), included in many business-grade solutions, catches both. In Enterprise mode, also configure devices to validate the server certificate before sending credentials.

To find out what an intruder could actually do once connected, an internal penetration test can include a wireless component. Like any penetration test, it requires written authorization (Criminal Code, s. 342.1).

Beyond the office: remote work and public Wi-Fi

Your office Wi-Fi is only part of the picture. The Cyber Centre recommends avoiding public Wi-Fi for business, using a VPN when travelling, turning off automatic connection and forgetting networks you no longer use. Our article on remote work security also covers home routers.

Where to start

A proper Wi-Fi assessment happens on site: someone has to see the access points, measure how far the signal reaches and spot unknown devices. Our team can visit your office in Greater Montréal, then help with remediation and hardening of your network. Before the visit, gather what you can: the make and model of your router and access points, who installed them, and the list of networks you currently broadcast.