What Is Wireless Security?

Wireless networks extend beyond the building, which is the whole security problem. An attacker does not need to enter the premises — proximity is sufficient, and proximity includes the car park, the floor above and the street.

Encryption standards, briefly

WPA2 with a strong configuration remains acceptable; WPA3 improves on it meaningfully, particularly by protecting against offline attacks on captured handshakes. WEP and WPA are broken and should not exist anywhere — though they persist in older equipment, particularly industrial and building systems.

For corporate networks, enterprise mode with 802.1X is substantially better than a shared passphrase. A shared key is known to everyone who has ever used it, including departed staff and anyone they told, and changing it means reconfiguring every device.

Guest networks are where separation fails

Guest wireless should reach the internet and nothing else. The common failures are guest traffic sharing infrastructure with corporate traffic in a way that permits crossing, guest networks able to reach internal ranges, and no client isolation so guests can attack each other.

In clinical and industrial environments this matters more than usual, because the same physical infrastructure frequently carries guest, corporate and operational traffic. See separating guest access from clinical systems.

Rogue access points, both kinds

An unauthorised access point is one a staff member connected for convenience, usually with weak or no security, creating a path into the network that bypasses every wireless control you configured.

An evil twin is an attacker's access point advertising your network name, which devices may connect to automatically. It captures credentials and positions the attacker between users and the network. Client-side server certificate validation is the defence, which is why that setting matters so much.

Legacy devices constrain the whole network

The recurring obstacle to modern wireless security is equipment that cannot support it — older medical devices, industrial handhelds, barcode scanners and building systems that support only outdated encryption or cannot do enterprise authentication.

The wrong response is weakening the main network to accommodate them, which exposes everything to the lowest capability present. The right one is a separate network with its own credentials, tightly restricted in what it can reach, accepting that its wireless security is weak and containing the consequence.

That segment then becomes a candidate for replacement planning, with a documented risk acceptance in the meantime rather than an unexamined compromise.

Physical placement of access points is a control in its own right. Devices mounted in publicly accessible areas can be removed, reset to factory defaults or replaced with an attacker’s hardware, and a console port on a reachable device is a path around every wireless control configured on it.

A common mistake worth avoiding

Where to start

Walk the perimeter with a phone and see where your corporate network is still usable. Then check whether the guest network can reach anything internal. Both take an afternoon.

GuardsArm delivers wireless penetration testing.