Wireless security and authentication

Before you read. The wireless password is written on a whiteboard in the meeting room. Forty people know it, along with everyone who has ever visited, and it has not changed in three years because changing it means visiting forty devices.

Somebody leaves the company on Friday.

What actually has to happen, and what will actually happen?

Wireless security has two halves that get taught as one. There is the cryptography, which is mostly a matter of choosing the current option and moving on. And there is the credential model, which is an operations problem that outlives every device on the network, and which is what the scenario above is about.

Some words you will need

WPA2: The security scheme most networks still run. Sound if configured well, with one structural weakness in its handshake.
WPA3: The current one. Its main change is how two ends agree a key.
pre-shared key: One passphrase, known by every device on the network. Frequently written PSK, and also called personal.
enterprise: Each user or device authenticating as itself, checked by a separate server.
802.1X: The IEEE standard for controlling access to a port, wired or wireless, until the device has authenticated.
RADIUS: The protocol carrying that authentication to the server that answers it.
client isolation: Stopping devices on the same network from reaching each other.

What breaks without this

The credential outlives the people. A shared passphrase that cannot practically be changed is a credential that everybody who has ever worked there still holds.

Guest wireless is assumed to isolate and does not. Addressing guests separately and stopping them reaching each other are two different settings, and only one of them is obvious.

The wrong thing gets deployed for the size of the site. Enterprise authentication is right for an office and heavy for a shop with one access point, and knowing what it requires prevents both mistakes.

What WPA3 changed

WPA2 has a specific structural weakness and it is worth stating precisely, because the vague version leads people to the wrong conclusions.

When a device joins a WPA2 network it performs a four-way handshake with the access point, which derives the session keys from the shared passphrase. That exchange can be captured by anyone in range, and once captured it can be attacked offline: an attacker guesses a passphrase, derives what the handshake would have looked like, and compares. No further contact with the network is needed and there is no rate limit, because the attack is happening on somebody else’s computer.

So the strength of a WPA2 network is entirely the strength of its passphrase, and against a captured handshake a weak one falls quickly.

The difference is not in the encryption, which is why calling WPA2 broken misleads. It is in where the guessing happens. A WPA2 handshake is captured once from the air, and every guess after that is made on the attacker's own machine at whatever speed it manages, with the network never contacted again and therefore unable to count the attempts, slow them down, or notice at all. WPA3 changes the key agreement so each guess has to be made against the live access point, which turns an unlimited offline problem into a rate limited and observable one.

WPA3 replaces that key agreement with one where the offline attack does not work. Each guess has to be tested against the live network, which makes the attempt rate observable and limitable rather than free. That is the substantive change.

Two smaller ones are worth knowing. WPA3 also encrypts traffic on open networks, so a public network with no password still gets each client its own encryption against passive listeners, which WPA2 did not offer at all. And it requires protected management frames, which closes off a family of attacks that worked by forging the messages that disconnect a client.

If you already work on networks: why WEP and the original WPA are not on this exam, and why that is unusual

Objective 2.3 names WPA2 and WPA3. WEP is absent, and so is the original WPA.

That is a departure from how this subject is usually taught, where the treatment walks through WEP’s failure, then WPA as the interim fix, then WPA2. It is a good story and it explains why things ended up as they are.

Whatever the reasoning behind leaving it out, the omission is defensible. The exam tests what you should configure, and somebody who can recite WEP’s weaknesses but reaches for WPA2 personal in a building of forty people has learned the history and missed the job.

What is worth carrying from it, in one paragraph, is the shape of the failure rather than the mechanism: WEP’s problem was not that its cipher was weak in the abstract, it was that the way it used the cipher leaked key material with ordinary traffic, so an attacker gained by waiting rather than by computing. That is a different class of flaw from a short passphrase, and it is why the answer was a new scheme rather than a longer key.

If you already know the history, keep it. If you are learning this for the exam, learn WPA2 and WPA3 and spend the time you saved on the credential model below, which is where the real decisions are.

Shared key against per-user identity

The cryptography above is a choice you make once. This is the one you live with.

Pre-shared key means one passphrase for the network, held identically by every device on it. Simple, works everywhere, requires no infrastructure, and has one property that dominates everything else: the secret is shared, so it can only be revoked collectively.

Enterprise means each user or device authenticates as itself against a separate server. Every device gets its own session keys derived from its own authentication, and access can be granted or removed one account at a time.

The same five devices under each model, and the difference only shows when somebody leaves. On the left every box holds an identical copy of one secret, so the box marked in red cannot be dealt with on its own: revoking its access means changing the secret in all five, and in a real office that includes the printer and whatever is on the wall in the warehouse. On the right each box proves who it is to a server, so the same departure is one account disabled and nothing else touched. The encryption protecting the traffic is the same in both drawings.

Now the scenario at the top, honestly. What should happen when somebody leaves a PSK network is that the passphrase changes, on the access points and then on every device that uses it, including the ones nobody thinks of: the printer, the handheld scanner in the warehouse, the thermostat, the two laptops belonging to people on holiday. What will actually happen is nothing, because that job is a day of work and the risk feels abstract on the Friday somebody leaves.

That is not a failure of discipline. It is the credential model working exactly as designed, and it is the reason enterprise authentication exists at all. The cryptography is the same either way.

If you already own this decision: what a shared key actually costs when somebody leaves

The revocation problem is easy to state and its real cost is in what happens instead of revocation.

Changing a shared passphrase means touching every device that uses it. On a network with phones, laptops, printers, cameras, a couple of tills and a machine in a cupboard that somebody configured in 2019, that is a day of work and a list nobody has. So the passphrase does not get changed, and the practical result is that a shared key network is one where credentials are never revoked at all. The control exists on paper and is too expensive to use.

Two things follow. The first is that the exposure grows quietly: everybody who has ever worked there, every contractor, every visitor who was given it, all still hold a working credential. The second is that nobody knows how large that group is, because sharing a passphrase leaves no record.

Which is why the honest way to choose is to ask how often somebody leaves and how much it would cost to re-key. A household or a small office with stable occupants can live with a shared key indefinitely. Anywhere with staff turnover, the answer arrives the first time somebody is dismissed rather than resigning, at which point the question stops being theoretical and there is no good option left.

An intermediate step worth knowing: a separate network with its own key for the devices that cannot do anything better, kept small deliberately, so that the population which forces the shared key does not force it on everybody.

What enterprise authentication involves

Three parties, and naming them makes the rest readable.

The supplicant is the device asking for access. The authenticator is the access point or switch controlling the port, which starts out allowing nothing through except the authentication conversation itself. The authentication server is what actually decides, and the authenticator forwards to it rather than answering.

802.1X is the framework for that, and it is not a wireless standard: the same mechanism controls a wired switch port, which is why it turns up again in the security block. EAP is the family of methods carried inside it, and there are many, differing in what the device presents: a password, a certificate, or a certificate on both sides. RADIUS is the protocol carrying the conversation from the authenticator to the server.

Two things follow that are worth knowing before proposing this.

It needs a server, and the server becomes load bearing. If it is unreachable, nobody new can join. Existing sessions usually continue, which means the failure is invisible until the first person tries to connect in the morning.

And it needs the client configured to check the server, which is the step most often skipped. If a device is set to authenticate but not to verify the server’s certificate, an attacker can stand up an access point with the same name, collect the authentication attempt, and the client will hand it over. The protection depends on the client caring who it is talking to, and the default in a lot of manual configuration is that it does not.

If you already run this: the certificate check clients skip, and why that undoes it

The three-party model is sound and there is one step in it that clients routinely get wrong, which turns strong authentication into an ordinary password prompt.

The authentication server presents a certificate, and the client is supposed to check it before sending any credentials. That check is what makes the exchange safe: it confirms the client is talking to the organisation’s own server rather than to something advertising the same network name. A client that does not validate, or that validates against any certificate rather than the expected one, will happily authenticate to whatever answers, and the credentials go with it.

Left to their own devices, users prompted to trust an unknown certificate accept it, because the prompt appears at the moment they are trying to get online and accepting makes it go away. So the configuration has to be pushed rather than requested: the expected certificate authority and the expected server name configured on the device by whatever manages it, with the option to accept anything else removed.

Which is the sharp end of a general point about this design. Moving from a shared passphrase to per-user identity is a genuine improvement in what can be revoked and audited, and it delivers that only if the client end is configured properly. A badly configured enterprise network can be weaker than a shared key, because it looks stronger and hands out individual credentials to anything that asks.

Guest isolation is a separate setting

The previous topic made this point from the network side and it belongs here too, because it is a security control rather than a design detail.

Putting guests on their own SSID and their own VLAN stops them reaching the internal network. It does nothing about guests reaching each other, because they are all on one segment and traffic between two devices on the same segment does not pass through anything that could stop it.

Client isolation is the setting that stops it, and it works at the access point by refusing to forward frames from one associated client to another. It is usually a single checkbox and it is off by default on a lot of equipment.

The case for turning it on is not theoretical. A public network without it is a shared segment on which every device is reachable by every other, and a laptop with file sharing left on at home is now offering it to a coffee shop.

Prove it

Nothing captured here, for the reason the whole wireless block gives: the lab has no radio. Two documents and one thing to check.

IEEE 802.1X. The scope is readable without purchase. Read it and answer one question: does the standard describe itself as wireless, and what does the answer tell you about where else you will meet it?

RFC 3748. Free, and worth ten minutes. Read the introduction and answer a narrower question: is EAP an authentication method, or a framework that carries them? Getting this right is the difference between the exam’s vocabulary making sense and not.

Then look at your own client configuration. On any device joined to an enterprise wireless network, find the settings for that network and look for whether it validates the server certificate and which authority it trusts. If the answer is that it does not validate, you have found the gap the last section described, on a real network, in about a minute.

What trips people up

1. Thinking WPA3 fixed a broken cipher

WPA2’s encryption is not the weakness. The weakness is that its handshake can be captured and attacked offline at no cost, so the passphrase is the whole defence. WPA3 changes the key agreement so guesses have to be made against the live network.

2. Treating the credential choice as a security setting

Pre-shared key and enterprise use the same cryptography. What differs is whether access can be revoked for one person, and that is an operations property rather than a cryptographic one.

3. Believing a shared passphrase gets changed when somebody leaves

It rarely does, because changing it means touching every device including the ones nobody remembers. Assume any long-lived shared key is held by everyone who has ever been in the building.

4. Deploying enterprise without a plan for the server being down

Existing sessions usually survive, so the outage is invisible until people start arriving in the morning and nobody can join.

5. Skipping server certificate validation on clients

A client that authenticates without checking who it is authenticating to will hand its credentials to an access point with the right name. This is the most common way enterprise wireless is undermined.

6. Assuming a guest VLAN isolates guests from each other

It separates them from the internal network. Client isolation is the separate setting that stops guests reaching each other, and it is frequently off by default.

Work it through

Friday, somebody leaves, and the network uses a pre-shared key.

Start by being clear about what they still hold. Not an account, because there is no account. They hold the passphrase, which is the same passphrase every device has, and which grants full access to whatever the wireless network reaches. There is no per-user revocation available, because there was never anything per user.

Then work out what changing it costs, because that number decides what actually happens. Every device that joins the network needs the new one: laptops, phones, printers, anything embedded, anything belonging to someone away that week. Some of those have no screen and are reconfigured by a method somebody will have to look up. In an office of forty people this is a day of somebody’s time and a week of stragglers.

That arithmetic is why the honest answer to “what will happen” is usually nothing, and it is worth saying out loud in the meeting rather than pretending otherwise. A control that is never exercised is not a control.

So the real options are two. Accept it, and treat the wireless network as semi-public: put it outside the internal network, require a VPN or per-application authentication for anything that matters, and stop pretending the passphrase is a security boundary. Or change the credential model, which means enterprise authentication, a RADIUS server, and clients configured to validate it.

The second is more work up front and it is the one that makes the Friday question answerable, because leaving becomes one account disabled. Which to choose depends on the size of the site and what the network reaches, and the useful way to frame it is not security against convenience. It is whether you want the answer to “somebody left” to be a day of work or a checkbox.

And the thing to do regardless, on Friday, costing nothing: check whether the guest network shares the passphrase with the main one, and check whether client isolation is on. Both are quick and both are commonly wrong.

Try it

Find out what your own wireless is using. Every operating system will tell you the security type of the network you are on. If it says WPA2 personal, the passphrase is the whole defence.

Check whether your client validates the server. On an enterprise network, look at the network’s settings for certificate validation. This takes a minute and the answer is frequently no.

Test client isolation on a network you administer. Two devices, try to reach one from the other. If it works, isolation is off.

Check yourself

What is the actual weakness in WPA2 that WPA3 addresses?

That its four-way handshake can be captured by anyone in range and then attacked offline. An attacker guesses a passphrase, computes what the handshake would have looked like, and compares, without contacting the network again and without any rate limit.

So a WPA2 network’s security is the strength of its passphrase and nothing else.

WPA3 replaces the key agreement so that each guess must be made against the live network, which makes the attempt rate visible and limitable. It also encrypts traffic on open networks and requires protected management frames.

Pre-shared key and enterprise use the same encryption. So what is the difference?

Revocation.

With a pre-shared key there is one secret, held identically by every device, so access can only be withdrawn from everybody at once. Removing one person means changing the passphrase everywhere, including on devices nobody remembers.

With enterprise each device authenticates as itself, so removing one person is one account disabled and nothing else is touched.

That is an operations property rather than a cryptographic one, which is why comparing them on strength misses the point.

Name the three parties in an 802.1X exchange and what each does.

The supplicant is the device asking for access. The authenticator is the access point or switch holding the port closed to everything except the authentication conversation. The authentication server decides, and the authenticator forwards to it rather than answering itself.

EAP is the family of methods carried inside the exchange, and RADIUS is the protocol carrying it from the authenticator to the server.

Worth noting that 802.1X is not a wireless standard. The same mechanism controls a wired switch port.

Why is a client that does not validate the server certificate a serious problem on enterprise wireless?

Because the protection depends on the client caring who it is talking to.

An attacker can stand up an access point advertising the same network name. A client configured to authenticate but not to check the server’s certificate will begin the exchange and hand over its credentials, and nothing warns the user.

Validation is the step that makes the credential worth having, and it is the step most often skipped when a network is configured by hand on each device.

Guests are on their own SSID and their own VLAN. What are they still able to do?

Reach each other.

The VLAN separates guests from the internal network. It does nothing about traffic between two devices on the guest segment, because that traffic never passes through anything that could filter it.

Client isolation is the separate setting that stops it, implemented at the access point by refusing to forward between associated clients. It is commonly off by default, which makes a public network a shared segment full of strangers’ machines.

References

IEEE 802.11 - IEEE Standards Association, which defines the handshake and the management frame protection described here. Scope readable without purchase. Accessed 2026-08-11.
IEEE 802.1X - IEEE Standards Association, port-based network access control, which is wired and wireless rather than wireless alone. Accessed 2026-08-11.
RFC 2865 - IETF, the RADIUS specification. Free. Accessed 2026-08-11.
RFC 3748 - IETF, which defines EAP as a framework carrying authentication methods rather than as a method. Free. Accessed 2026-08-11.

Where the numbers came from. Nothing on this page is captured: the lab behind this track is Linux network namespaces and has no radio, and capturing a handshake from a network to demonstrate an offline attack would be neither legal nor useful here. The forty devices in the diagram are the scenario’s number rather than a measurement. The claim that client isolation is off by default on a lot of equipment is a generalisation about vendor defaults rather than a figure, which is why it is written as one.

If you also work on Linux. wpa_supplicant is the client side of all of this, and its configuration file is the clearest place to see the difference between the two models: a PSK network is a passphrase, and an enterprise one names an EAP method, an identity, and the certificate authority it will accept. That last setting is the validation the page above says is skipped, and in a hand written config its absence is visible rather than buried in a dialog.

On the examCompTIA Network+ N10-009 (V9)

Before this

What you will be able to do