Whether you’re using a private or business network, the need for security is a top priority. Tra­di­tion­al networks that use cables can provide some pro­tec­tion against external attacks. This is because without physical access to the cables, which run through buildings, strangers cannot easily intercept or read data.

However, if you want to use a more practical wireless network, you have a higher chance of en­coun­ter­ing security problems. If a device in the wireless local network – better known as WiFi – sends data, a spy only needs a receiver within the range of trans­mit­ted radio signals to intercept this data. In order to use this form of wireless com­mu­nic­a­tion path without any worries, it is important to ensure you have good WiFi security.

What actually is WiFi?

WiFi is a wireless tech­no­logy and is a type of WLAN (Wireless Local Area Network). It’s used to connect computers, tablets, smart­phones and other devices to the internet. Wireless con­nec­tions are par­tic­u­larly wide­spread in the private sector, since they are a good solution for im­ple­ment­ing internet access through entire living quarters without having to rely on cables. Radio networks are also useful in offices, es­pe­cially when a variety of portable devices such as laptops, tablets or smart­phones are in use.

There are three different modes for operating wireless networks:

  • In­fra­struc­ture mode: The structure of this mode is similar to a mobile network. A wireless access point takes care of the co­ordin­a­tion of all network users and sends them small packets, at ad­justable intervals, with in­form­a­tion about the network name, the supported trans­mis­sion rates and the type of en­cryp­tion. The access point is often a router.
  • Wireless dis­tri­bu­tion system: A WDS is used to extend a WiFi hotspot to a larger geo­graph­ic area without the need to connect wires to each access point. This is also how networks are linked together.
  • Ad-hoc mode: In ad-hoc networks, the central control unit is missing, which means that the co­ordin­a­tion must be taken over by the re­spect­ive terminals. These networks are used for fast, direct com­mu­nic­a­tion between in­di­vidu­al par­ti­cipants. However, this mode isn’t used as fre­quently. Al­tern­at­ive tech­niques, such as Bluetooth, are much more common.

The dis­ad­vant­ages of wireless networks

The standards for com­mu­nic­a­tion in radio networks have been specified by the Institute of Elec­tric­al and Elec­tron­ics Engineers (IEEE) in New Jersey in IEEE 802.11. At the beginning, however, not much emphasis was placed on security. Un­en­cryp­ted trans­mis­sion and an absence of user au­then­tic­a­tion re­quire­ments meant that anyone within the ap­pro­pri­ate area had access to a wireless network. Ul­ti­mately, the re­quire­ment of WiFi security promoted the de­vel­op­ment of the following en­cryp­tion and au­then­tic­a­tion methods:

  • Wired Equi­val­ent Privacy (WEP): WEP is the oldest standard for WiFi en­cryp­tion and dates back to 1997. It offers two au­then­tic­a­tion methods: open system au­then­tic­a­tion (enabled for all clients) and shared key au­then­tic­a­tion (activated by password). In addition, WEP includes the en­cryp­tion methods RC4. Due to various weak­nesses, WEP is con­sidered unsafe and outdated today.
  • WiFi Protected Access (WPA): WPA builds on the WEP ar­chi­tec­ture and is designed to eradicate weak­nesses in the same process. To ensure this, WPA operates with a dynamic key based on the Temporal Key Integrity Protocol (TKIP). Since WPA also has certain security de­fi­cien­cies, new wireless access points (since 2011) and all WiF-enabled devices (since 2012) are no longer allowed to support this protocol.
  • WiFi Protected Access 2 (WPA2): The current, safest WLAN en­cryp­tion and au­then­tic­a­tion method WPA2 was released in 2004 with the IEEE 802.11i standard. Instead of TKIP, WPA2 uses the much more modern AES en­cryp­tion method. Therefore, if you want tight WiFi security, you should opt for WPA2 instead of the older WEP and WPA standards.
  • WiFi Protected Setup (WPS): The standard WPS is not a trans­mis­sion nor en­cryp­tion technique, but is rather an automatic con­fig­ur­a­tion feature, which aims to make setting up a WiFi network easier for new users. The au­then­tic­a­tion is carried out at the push of a button (WPS PBC) – phys­ic­ally at the access point or virtually via a software-im­ple­men­ted button – or by entering a PIN (WPS PIN). Al­tern­at­ively, you can change the network settings via USB stick or via NFC (Near Field Com­mu­nic­a­tion).

Although WEP and WPA have a le­git­im­ate, more secure successor with WPA2, some operators are still using these outdated standards (as long as they are supported by the wireless action point) in order to encrypt their network. Whether this is un­in­ten­tion­al or for com­pat­ib­il­ity reasons (to grant access to older devices) is in­cid­ent­al. What is clear is that networks like this are at a high risk of un­au­thor­ised access, which is one of the main reasons for the critical as­sess­ment of WiFi security. Ad­di­tion­al errors that make it easier for attackers to intercept data include:

  • Having standard usernames and passwords for wireless access points
  • Having unsafe basic con­fig­ur­a­tions for wireless access points
  • Im­ple­ment­ing WPA2 and WPS in­cor­rectly

In addition, wireless networks are vul­ner­able to common DoS or DDoS attacks as well as evil twin attacks. With the latter, malicious attackers plant fake wireless access points in the network with special firmware. Network users believe these to be real and then connect to them. The evil twin responds with its own au­then­tic­a­tion request and receives the access data from the un­sus­pect­ing network device. It also takes over the MAC address of the client (MAC spoofing), obtaining all necessary data to establish the con­nec­tion. Publicly ac­cess­ible WiFi points are par­tic­u­larly at risk for this kind of attack.

The im­port­ance of WiFi security

The weak­nesses listed above show the im­port­ance of becoming familiar with various pos­sib­il­it­ies for in­creas­ing WiFi security. If you expect to get the best pro­tec­tion with a firewall and a secret password, you will quickly find that these don’t do much if you fall victim to a targeted attack. There’s more to the com­pre­hens­ive security of wireless networks than just simply turning on a router, carrying out a five-minute setup, and searching for a password that is easy for you to remember and hard for others to guess.

The more careful you are with the con­fig­ur­a­tion and man­age­ment, the more secure your network will be.

How to configure wireless access points correctly for better WiFi security

Wireless access points – usually routers – are the network’s central control units and are therefore re­spons­ible for their safety. How you adjust the settings for this hardware component can strongly influence whether an attacker can gain access to your wireless network within a few seconds, or whether their attempt is thwarted. These are the most important con­fig­ur­a­tion steps:

Step 1: Create in­di­vidu­al ad­min­is­trat­or access

To configure access points, firmware needs to be running. This provides you with a user interface in any regular web browser as soon as you access the IP address of the access point. Access to this interface is achieved through an ad­min­is­trat­or account with a default username and password. This login data is the same for all devices of the re­spect­ive model and is also very easy to remember. It may be, for example, ‘admin’ (password and username) or ‘1234’. Change this ad­min­is­trat­or account login in­form­a­tion at the beginning of the con­fig­ur­a­tion. You can write it down and store it in a safe place, but do not store it on your computer without proper password storage.

Step 2: Select WPA2 as the en­cryp­tion method

In order to encrypt your WiFi, you should def­in­itely choose WPA2, since the two pre­de­cessors WPA and WEP are outdated and could prove a security risk. Combining or mixing WPA/WPA2 isn’t re­com­men­ded either. Instead, use network devices that support WPA2 and do not rely on old en­cryp­tion methods. If you are using WPS con­fig­ur­a­tion software, you should only switch it on when it is needed.

Step 3: Create a secure network password

So far, only password attacks have been known for WPA2. In par­tic­u­lar brute force attacks and dic­tion­ary attacks are very popular with cy­ber­crim­in­als. This is why it’s important not to un­der­es­tim­ate the im­port­ance of a complex password. Your best bet against de­cryp­tion al­gorithms and dic­tion­ar­ies that tools use is to set up a WLAN key con­sist­ing of as many char­ac­ters as possible. It’s important to use both lowercase and uppercase letters as well as numbers and special char­ac­ters. Avoid actual words and use random char­ac­ters. You can also keep this password on paper in a safe place, just don’t write in on your computer.

Step 4: Specify an uniden­ti­fi­able network name

Another WiFi security measure is to formulate a non-traceable service set iden­ti­fi­er (SSID). The SSID displays the name of your network and is available to all in the signal range. If you are not running a public hotspot, you should avoid personal details that might be traced back to you, your company or your location. Many consider it more secure to hide the network’s name (hidden SSID). However, this technique doesn’t fully deter attackers and makes the con­nec­tion set up a bit more difficult for le­git­im­ate clients. If you hide your network’s SSID, it could prevent some devices from seeing the access point, resulting in them not being able to connect to it.

Step 5: Turn on automatic firmware updates

For good WiFi security, it’s paramount that the wireless access point’s firmware is up to date. As with any software, attackers can take advantage of security flaws and take over admin rights or let malware in­filt­rate the system. Some access points have an automatic update function for the installed firmware, which you can promptly activate. If this isn’t the case, you should regularly check whether there are any updates for your device that you can download and install manually.

Optimise au­then­tic­a­tion with IEEE 802.1X

IEEE 802.1X is a port-based security concept that only grants con­nec­tion-enabled clients access once they are verified and approved by an au­then­tic­a­tion server (RADIUS). This is based on a pre-defined list, which provides security concept in­form­a­tion about whether the re­quest­ing client is allowed to connect to the wireless access point. The au­then­tic­a­tion method relies on the Ex­tens­ible Au­then­tic­a­tion Protocol (EAP), which also supports WPA2. Also mentioned with this variant are WPA2 En­ter­prise, WPA2-1X, and WPA2/802.1X.

Ad­di­tion­al useful WiFi security measures

If you have con­figured your wireless access point ac­cord­ingly, your wireless network already has decent pro­tec­tion. Be sure to adjust the firewall included in the access point or configure your own firewall to filter unwanted con­nec­tions on your WiFi network. It is also useful to consider intrusion detection or an intrusion pre­ven­tion system, in order to detect and prevent attacks as early on as possible.

If you want to provide customers with wireless internet access, you should always work with a separate SSID, which you create and configure in addition to your workplace network. In any case, as an operator of the wireless network, you are jointly re­spons­ible for how the con­nec­tion is used since any copyright in­fringe­ment could quickly be traced back to you. To be safe, you should keep track of bandwidth usage and block any un­trust­worthy sites in the router settings.

Per­form­ing regular security checks with the help of special tools is def­in­itely re­com­men­ded. These help to simulate common hacker attacks and find out whether your WiFi security measures are working. The more thorough and precise you are, the better. Make sure to

  • configure your wireless access point,
  • install ad­di­tion­al security com­pon­ents such as IEEE 802.1X, a firewall or an intrusion detection system,
  • operate work and guest networks sep­ar­ately
  • regularly make sure your network com­pon­ents are updated and are per­form­ing correctly.

By carrying out these steps, it’ll be harder for hackers to gain access to your WiFi network.

Go to Main Menu