Wireless networks broadcast traffic openly through the air, making them vulnerable to interception and unauthorized access. This content covers the core strategies for securing wireless environments, including signal management, authentication methods, encryption standards, and network isolation techniques.
Wireless Network Security
Wireless networks are inherently insecure. There are so many opportunities for hackers to hack into wireless systems and for things to be leveraged in a wireless network. That's because all the communication is through the air and can be picked up by anyone. So it's vital that you make sure that your wireless networks have a lot of security built into them. There's a lot of things that we have to do to secure wireless.
The problem with wireless is it's all through the air. So we have a wireless access point here, and any device that is within listening range of this wireless network can hear all of the traffic that's being put out by this wireless access point. It doesn't matter if the machine is on one side of the wireless access point and another machine is on the other side of the wireless access point. Anything that this wireless access point broadcasts out gets sent out to everyone.
The first step in wireless security is making sure that your access points are not being broadcasted way beyond the walls of your business. So in this case right here, there are big gaps outside of the walls of this business that are being broadcasted to, giving opportunities for people to sit outside of the building and still have access to this network.
So one of the first things we want to do is choose placement of our access points and our antennas wisely — maybe shifting to have less access points that encompass more of the office area. Making sure there's still good coverage within the office, but it's not going far beyond outside the walls.
The other thing we can do, for small office buildings or for some tight locations, is perhaps drop the power of that antenna. These access points have power levels, and what we can do is drop that power level so it does not broadcast as far out.
Another thing that we can do is MAC address filtering. Your devices have a MAC address on the wireless network card, and so when it accesses an access point, then this access point will see that MAC address and can filter based off that MAC address. Now, MAC addresses can be spoofed, so this is not one way to implement security on your network, but it could be one of the steps that you could use to filter out certain clients or certain devices on your network.
One thing that's a must to secure your wireless networks is to set up some sort of authentication. In this example right here, I have a wireless access point and this client is trying to connect to it. What we have to do is somehow prove that the client is acceptable to get onto the network.
The most common way of doing that is using a pre-shared key. A pre-shared key is something that you would set up on the access point, and then when a client gets onto a device and wants to connect to this access point, it's going to prompt him for some sort of pre-shared key, or a passphrase, or a password. You will enter that into the laptop, and then it will use that to authenticate with this machine, and as long as you have the pre-shared key then you're able to get onto that network.
That's not the only way though. There are some uses like 802.1X that this device can use for something like certificates or usernames and passwords, to ensure that your machine can get onto that network. It will either use the certificate to get onto that network, or it'll prompt the user for a username and password.
One other way though is that you can have a captive portal. A captive portal is a way that this machine would make a connection to this access point, and then what would pop up on that screen's window is a sign-on box. It would use the browser of the machine with a log in, your username and password, and that can also be used to authenticate to get onto the network.
Of course, during this process of authenticating you still have to make sure that it's secure. You don't want that information just being sent out there. So extensible authentication protocol, or EAP, is one of those technologies, one of those protocols that can be used for these two devices to authenticate, so that this machine can authenticate with the wireless access point to get onto the network and do it in a secure manner, so that not everyone is seeing the credentials that are being passed back and forth between these two devices.
Of course, once the authentication happens, you still need encryption to encrypt the traffic that's happening between these two devices, because once again, anybody that is in between here can listen to the traffic that's going back and forth. So somehow we need to encrypt the traffic so this device cannot listen in on the conversation that's happening.
So we need to implement some sort of encryption, and that can be done in many different ways. You could use WEP, although it's not considered a secure method of encrypting this data. Other methods that can be used are WPA 1, 2 or 3. And obviously, as it works up, the higher the number the better the encryption is. So use WPA3, if you can help it, as the encryption method for your network.
Another thing that you can implement on your wireless network is wireless client isolation. What this does is it allows that these devices connect to this access point and talk with this access point and talk to other devices on the network, but it creates an isolation between these different devices. Now, this device still can listen to the traffic that's happening on the other devices — it's not going to stop the radio waves from getting to the other devices — but what the wireless client isolation does is it just doesn't allow one client to talk to another client when you are on this wireless network. So it isolates these clients so they cannot talk to one another.
Another thing that you see commonly on these networks is some sort of guest network. A guest network allows a user to get onto an access point and get out to the internet without ever touching the rest of your network. This keeps the rest of your network safe, but still allows guests to get onto the internet and be able to pull things off the internet without accessing the rest of your network.
We started talking about what the issues with wireless are and how it just broadcasts out in the open. We talked about shaping signals, so that way we are not broadcasting it as far as we could be broadcasting it. We need to make sure that it just stays as minimal as possible while servicing the people that we want to service. Then we get into some authentication and some ways that you could authenticate users to make sure that they should be on your network. We also talked about encryption, and finally a couple of ways of isolating traffic so that way one client can't speak to another client, or guests can get onto the internet using your internet connection.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →