To secure a wireless network, use the strongest encryption your devices support (WPA3 where possible), protect the administrator login, keep guests and unmanaged devices on a separate network, and treat Wi-Fi as an untrusted edge. Authentication and encryption of the wireless link are baseline controls, not extras.
What do the standards ask for?
NIST SP 800-53 control AC-18 Wireless Access asks organizations to establish configuration requirements, connection requirements and implementation guidance for each type of wireless access, and to authorize each type before allowing connections. Its first enhancement calls for protecting wireless access with authentication and encryption.
That gives a mental model. For every way a device can join your wireless network, someone decided it was allowed and set the rules. "Anyone who can see the signal" is not a rule.
What does WPA3 change?
The Wi-Fi Alliance says WPA3 is mandatory for Wi-Fi CERTIFIED devices. On its security page it describes these points: WPA3-Personal gives added protection against password guessing; WPA3-Enterprise offers higher-grade security protocols for sensitive data; WPA3 networks disallow outdated legacy protocols; Protected Management Frames are required for new certified devices; and Wi-Fi Enhanced Open provides encryption without authentication, so a public passphrase does not need to be maintained or shared.
The page does not give a detailed comparison with WPA2, so check device documentation for what each of your devices supports. Mixed mode networks that allow older clients lower the protection for everyone, so understand the tradeoff before enabling them.
Where do wireless networks usually get weak?
Rarely in the cryptography. More often in operations:
- The router's admin password is still the default, or the admin page is exposed to the internet.
- Firmware is years old.
- One flat network holds laptops, cameras, printers, guest phones and a smart television.
- A shared passphrase never changes, even after people leave.
- A forgotten access point, plugged in by someone for convenience, creates an unmonitored way into the wired network.
How do you handle guests, visitors and remote devices?
Guests are the easiest group to forget. A visitor's phone may carry malware, and you cannot inspect it. A separate guest network keeps that risk away from your printers and file servers. Give it its own name and passphrase, change the passphrase on a schedule, and consider a captive page or voucher system if many people pass through.
Staff phones and personal laptops raise a similar question. If a personal device joins the staff network, it inherits everything staff can reach. A narrower network, or access only through a managed application, limits the harm if the device is compromised. AC-18 asks for rules for each type of wireless access, so write down which device types may join which network.
What does a good layout look like?
A constructed example for a ten-person office. The staff network uses WPA3-Enterprise or, if no authentication server exists, WPA3-Personal with a long random passphrase stored in the password manager. A guest network has its own name, its own address range and no route to internal systems. Printers and cameras live on a third segment that can talk out to what they need and nowhere else.
The router's admin interface is reachable only from the staff network, with a unique password, and firmware updates are on the calendar each quarter. The team scans for unknown access points once a month, walking the office with a phone app or checking the switch for unexpected devices.
How to check or apply this
- List every device type that joins wireless, and note whether it supports WPA3. Replace or segregate those that cannot.
- Change the router's admin password, disable remote administration unless required, and update the firmware.
- Use a long random passphrase for WPA3-Personal, and change it when someone with access leaves.
- Create a guest network with no access to internal resources.
- Put IoT and unmanaged devices on their own segment with restricted access.
- For larger sites, use WPA3-Enterprise so each person authenticates with their own credentials.
- Look for rogue access points on a schedule, and write down who may add one.
- On public Wi-Fi, assume the network is hostile and prefer encrypted connections and a VPN for non-web traffic.
Quick check
Is hiding the network name a security control?
No. It does not stop encryption weaknesses or password guessing, and it makes devices harder to manage. Spend the effort on encryption, passphrase strength and segmentation instead.
Is WPA3 enough on its own?
No. It protects the wireless link. You still need admin hardening, updates, segmentation and monitoring.
Sources
Last reviewed: 18 October 2026.
