Wi-Fi Security for Organizations

Mis à jour le 31 octobre 2026

Wi-Fi security

The publication Wi-Fi Security — Practitioner is an unclassified publication issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). It took effect on March 31, 2022; its revision history lists revision 1, the first release, on that date. It is intended for organizations of all sizes, public and private, that use Wi-Fi.

Wi-Fi is used in homes, workplaces, and public places. As organizations rely more on it, they need to address wireless-network security to reduce cyber-threat risks. Wi-Fi carries out critical tasks and may transmit sensitive or confidential information, including trade secrets, personal information (PI), and copyrighted material. A network is only as secure as its weakest link, and Wi-Fi is an easy target for threat actors. The publication covers vulnerabilities, recommended policies, technical controls, security measures, and additional considerations for network-wide security.

1. Wi-Fi threat awareness

Awareness, identification of risks, and remediation of known vulnerabilities in poorly secured Wi-Fi are first steps in securing a network. Wireless risks and organizational changes to reduce them include the following.

1.1 Network attack awareness

Unpatched firmware: Outdated firmware can leave a wireless network vulnerable to breaches. Threat actors may exploit firmware that has not been updated. A patching policy should schedule regular updates for all device firmware, including access points (APs) and controllers.
Insecure defaults: Wireless devices may ship with known usernames and passwords, bridges between network ports or VLANs, firewall rules that allow all traffic, and client isolation turned off on APs. Change default usernames and passwords to strong, unique credentials and harden each network device’s settings.
Shared networks: Separate network spaces for different roles, such as staff and guests, using client isolation, VLANs and switches, and firewall rules. Segment the network into security zones to reduce risk and the attack surface. After separating users into zones, separate wired and wireless networks into different segments within each division. Provided the firewall and network hardware block access between them, this prevents attacks on Wi-Fi from gaining direct access to wired devices and clients. For example, segregating guest and staff networks and then splitting each into wired and wireless zones results in four zones: two Wi-Fi and two wired.
Internet of Things (IoT) devices: IoT devices are commonly used in small office home office (SOHO) and small medium business (SMB) organizations. Poor security design and a lack of software or firmware updates create significant risks. Avoid them if possible, or segregate them onto a separate network.
Wardriving and parking-lot attacks: Wardriving is mobile reconnaissance, sometimes also an attack operation. It might use a van equipped with wireless analysis tools—such as a spectrum analyzer, powerful or highly directional receiving antennas, and mobile computing equipment—or just a laptop, cell phone, or tablet. Wardriving is not always malicious and is often used for research into common risks. Parking-lot attacks are more targeted and generally involve more than listening to wireless signals; the target may be outside conventional controls such as gates, secured doors, or camera systems. Limit signal strength so people nearby who are sitting, driving, or walking cannot launch wireless attacks on the network.
Device theft: Wi-Fi devices and modules are mobile and may be easy to steal. A smart lightbulb in a public place, for example, may contain Wi-Fi credentials; an attacker who accesses it could later use those credentials to connect to the network. Phones and tablets may also contain sensitive data, including sensitive personal information, and are easier to steal than desktop computers. Do not leave easily stolen devices containing sensitive information or access credentials in an untrusted location, unlocked, or physically unsecured.
Rogue access points: These are common in public Wi-Fi settings such as coffee shops, restaurants, airports, and other public Wi-Fi locations. Attackers may deploy a device that pretends to be a trusted local network; when a user searches for available networks, or a device connects automatically, the user may authenticate to the malicious AP. Verify that the network is the correct one and use encrypted communication. A guest with access to an organization can also spoof its corporate Wi-Fi network from a nearby location by deploying a malicious AP. Such attacks can cause data leaks and unauthorized access.
Weak authentication: Using a pre-shared key (PSK) instead of enterprise authentication is not recommended for organizations because everyone shares the same passphrase; it is not possible to determine who used it or whether the access is legitimate. When using Wi-Fi Protected Access (WPA) enterprise, a password policy is important to ensure passwords are sufficiently long and complex to resist compromise.
Weak encryption algorithms: Weak or outdated algorithms can make a wireless network easy to compromise. An attacker can use wireless tools and does not need to physically plug into the network. Recommended algorithms are referenced in ITSP.40.062, Guidance on Securely Configuring Network Protocols, and ITSP.40.111, Cryptographic Algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B Information.

1.2 Breach examples

In 2015, the zero-day vulnerability CVE-2015-0932 was discovered in ANTLabs InnGate routers. A zero-day is a computer or software vulnerability for which no patch is yet available. The vulnerability was quickly patched after discovery, but it caused breaches at 277 hotels, convention centres, and data centres. InnGate routers were commonly deployed on networks used by hotels and other organizations with guests. Attackers could take control of a router, install malware, attack connected systems, and completely control the Wi-Fi and wired networks to which guests connected.
Also in 2015, WeWork, a commercial real estate company, had poor Wi-Fi security for its building tenants. Anyone could pay $25 to access a boardroom and the Wi-Fi network, scan the network, and obtain sensitive information from businesses using it. The problem was not limited to one building: many WeWork buildings used the same PSK. The resulting incident exposed personal documents and other information, including driver’s licenses, passports, job applications, bank account credentials, contracts, and health records.
From January to June 2021, Kaspersky reported 1.51 billion IoT-device breaches, up from 639 million in 2020. These attacks typically used the Telnet protocol, which allows remote administration through a command-line interface. Attackers used them for distributed denial of service (DDoS) attacks, cryptocurrency mining, or pivoting to more valuable targets. The global pandemic increased the use and attention given to IoT devices.
A misconfiguration of the Extensible Authentication Protocol (EAP) was found on Eduroam, a free Wi-Fi network used by many universities across Europe. It could enable an “Evil Twin” attack: an attacker simulates the network and tricks devices into connecting to the wrong one. Since some operating systems do not validate the certificate when connecting, credentials used for Wi-Fi could be stolen. In the configuration described, Microsoft Challenge Handshake Authentication Protocol version 2 (MSCHAPV2) should have been used rather than the less secure Password Authentication Protocol (PAP).

2. Best practices

2.1 Data structures

Structuring resources helps make provisioning, maintenance, and security easier, while ensuring sensitive data is accessible only to those who need it. Without structure, data may be placed anywhere, with no distinction between sensitive and public information.

2.1.1 Limiting information available

Sensitive information—such as business-proprietary, classified, confidential, or personal data—should not be transmitted on open networks without additional encryption controls, because nearby threat actors can intercept communications. Apply least privilege, so each associate has access only to the files and resources required for their job. Further information is in ITSG-33, IT Security Risk Management: A Lifecycle Approach.

2.1.2 Structuring classes of data

Structuring data classes helps ensure sensitive data does not leave its protected area and limits damage from a data or privacy breach. Data should be structured to meet the organization’s security and privacy needs and protect personal and confidential information. One example has three classes:

Class 1: Public data. Data available to the public. Handling it internally or externally would cause no harm to the business, clients, staff, or vendors. Examples include public webpages, brochures, and business cards.
Class 2: Internal-only data. Data intended for authorized personnel inside the organization. It contains slightly sensitive information about operations, policies, or business plans. Examples include internal memos and business-related emails. Unauthorized disclosure could cause minimal harm to the business.
Class 3: Confidential data. Data limited to a specific group with special clearance or clear permissions. It may include PI whose compromise could cause great harm to the organization, individuals, and parties involved. It is typically protected under federal and private-sector privacy legislation, including the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), and may be protected under the Payment Card Industry Data Security Standard (PCI DSS) or regulated by the Investment Industry Regulatory Organization of Canada (IIROC) or the Mutual Fund Dealers Association (MFDA) of Canada. Examples include proprietary business data, research data, software source code, and other PI.

2.1.3 Structuring Wi-Fi and wired networks

Wi-Fi devices can have multiple service set identifiers (SSIDs). Each SSID should have its own VLAN to restrict access to internal network zones, along with other security measures. Beware of defaults that allow all traffic between SSIDs or VLANs. See the VLAN and SSID controls in section 2.3.2.

For guest Wi-Fi, limit how long a guest password can be used—for example, make it expire daily or issue guest passes—so only current guests can access the network. Further zoning information is in ITSG-38, Network Security Zoning – Design Considerations for Placement of Services within Zones.

2.2 Policy based

Written policy should fully reflect the organization’s security and privacy position; technical controls implement what the policy states. Technical controls without written policy may not withstand legal challenges.

2.2.1 Acceptable use policy

An acceptable use policy explains what a service, network, system, or website may and may not be used for. Its purpose is to reduce legal liability and clarify permitted use. It should specify permitted classes of web access, since some website categories can draw attention to the organization and increase risk. Pair the policy with controls that enforce it, such as a firewall web-filtering service.

2.2.2 Bring Your Own Device (BYOD) policy

Organizations that allow BYOD should have a policy enforcing additional restrictions on devices used in that environment. The policy must be enforceable and auditable. Anything that cannot be enforced or audited through technical controls should be treated as an organizational risk. The policy should define:

the process for vetting applications and permissions for apps and data;
minimum security precautions;
the classes of data stored on a device;
the purpose of providing this connection method to the organization;
proper methods for discarding, copying, and synchronizing data;
requirements for the method and type of device or application encryption; and
best practices considered necessary for secure operations.

2.2.3 Encryption and data security policy

This policy should specify which data must be encrypted, which algorithms are acceptable, and which parameters the organization considers secure. It should cover portable-media encryption, data at rest, and data in transit, and define a standard according to the data class.

2.2.4 Data governance policy

This policy should define data retention, acceptable destruction methods, and the general data lifecycle for each class. It should also set data-residency requirements and the controls in place.

2.2.5 Password policy

A password policy should set requirements for secure, acceptable password use. Minimal best practices might be enough in low-sensitivity environments; high-sensitivity environments, such as finance and healthcare, should require stronger measures. The policy should identify who can reset or change passwords and how credentials can be stored securely. The Cyber Centre does not typically recommend password expiration or password re-use. Further information is in ITSAP.30.032, Best Practices for Passphrases and Passwords.

2.2.6 Patching policy

A patching policy specifies what equipment is patched and how often. It should cover mobile devices, computer operating systems (OSs), applications, anti-malware or anti-phishing systems, and network equipment. It should schedule regular updates for all device firmware, APs, and controllers; identify authorized patching personnel; provide a back-out plan if updates fail; and specify who must be notified of a failed update and within what time.

2.2.7 Public Wi-Fi policy

A public Wi-Fi policy, either standalone or part of another policy such as an IT and network communication policy, should define appropriate use of public Wi-Fi such as coffee-shop, hotel, or unmanaged networks. It may require encryption of all data in motion, restrict access to confidential data classes, or set precautions to prevent threat actors from obtaining sensitive organizational data.

2.3 Technical control based

Technical controls should prevent security incidents and ensure data integrity through safe, secure access. Without them, device data can be accidentally or maliciously intercepted, falsified, or compromised.

2.3.1 Wi-Fi encryption and PSK versus EAP

Encryption methods:

Wired Equivalent Privacy (WEP) is easily compromised. It uses Rivest Cipher 4 (RC4), a stream cipher, for confidentiality and cyclic redundancy check (CRC32), a checksum algorithm, for integrity.
WPA 1 uses RC4 with Temporal Key Integrity Protocol (TKIP). It is described as a fairly strong encryption algorithm, but it is not secure enough for businesses handling sensitive information and should be avoided.
WPA2 is a strong, widely used Wi-Fi encryption method. Avoid Wi-Fi Protected Setup (WPS) with WPA2 to improve security. WPA2 uses 128bit Advanced Encryption Standard (AES) for encryption and Cipher Block Chaining Message Authentication Code Protocol (CCMP) for enhanced protection.
WPA3 is the newest and most secure form described. It uses 192bit AES in enterprise mode and 128bit in personal mode. Use it for all new deployments if available.

Choose an encryption method compatible with all devices and network equipment.

PSK versus EAP:

PSK is widely used for personal and SMB Wi-Fi, and is easy to implement, use, and support. It is not recommended for business use of any kind because it lacks identity management and audit capabilities. A passphrase secures the network and encrypts traffic, but once shared, the only way to lock someone out is to change the PSK. That disrupts users’ connectivity until they enter the new passphrase, and every device—including non-user devices such as wireless printers—must be updated. Small businesses have alternatives such as Lightweight Extensible Authentication Protocol (LEAP) and Protected Extensible Authentication Protocol Microsoft Challenge Handshake Authentication Protocol (PEAP-MS-CHAP). For large organizations, Extensible Authentication Protocol Transport Layer Security (EAP-TLS) is the most secure protocol that can be implemented. If PSK must be used, separate guests, staff, IT equipment, and IoT devices into different SSIDs, VLANs, and network segments, each with a unique passphrase.
EAP is commonly used in medium and large organizations. It supports username-and-password authentication for each device and TLS-based machine certificates. The most secure practice is to use TLS certificates alongside EAP, allowing access for an individual device to be disabled and improving visibility into Wi-Fi use; it also makes attacks more difficult. Single-Sign On (SSO) with PEAP-MSCHAPV2 adds convenience by authenticating against a directory and reducing the number of logins users must remember. PEAP-MSCHAPV2 lets users enter credentials that are authenticated by the Remote Authentication Dial-In User Service (RADIUS) server inside the EAP-encrypted tunnel.

2.3.2 VLANs and SSIDs

An SSID is what is commonly called the Wi-Fi or network name; it lets users identify a network to connect to. Never put PI or confidential data in an SSID. Personal users and small businesses commonly use one or two SSIDs, such as employee and guest networks.

VLANs create virtual networks on the same physical infrastructure; most managed switches and firewalls support them. Combine VLANs with SSIDs to create separate security zones. Use a VLAN separate from all wired traffic for wireless traffic, and configure the SSID accordingly. Put guest access on a restricted VLAN. Enable client isolation on all APs and SSIDs where available, to prevent clients communicating directly with one another.

Printers and IoT devices may not support WPA-EAP because of cost constraints. Place them on a separate, secure network isolated from employee and guest networks. Do not let users access these networks, and lock them down with a very strong password.

2.3.3 RADIUS

RADIUS works with EAP to provide secure authentication using a RADIUS server reached from an AP or AP controller. Ensure that the server uses a secure secret for devices to connect and authenticate; the secret is equivalent to a passphrase. Keep AP, AP-controller, and RADIUS-server software up to date, and manage accounts closely.

Many RADIUS servers connect to a directory for SSO authentication, typically Active Directory (AD) or an online cloud-directory service.

2.3.4 Directory security

The directory validates credentials, in addition to the roles of APs, controllers, and RADIUS servers. Use role-based access control (RBAC) and physical and cyber security policies to protect the directory service. AD is commonly used as the directory for SSO authentication. Secure the entire directory server, including its OS, applications, services, accounts, permissions, firmware, and hardware.

2.3.5 Virtual private networks (VPNs)

Public VPNs are typically used to protect individual privacy or hide a point of origin on public Wi-Fi. They should never be used for business connections. It can be difficult to assess provider reliability if the organization lacks resources to investigate the service’s security and infrastructure. Public VPNs often run on servers in countries without strict privacy and data-protection laws. Providers may not vet technical staff who can access both unencrypted data and customer identification and payment information.
Corporate VPNs are recommended for communicating with corporate resources over unmanaged networks, such as guest networks or public Wi-Fi. A corporate VPN creates an encrypted tunnel from the device to the corporate network, protecting data in transit. An attacker listening on the network cannot understand data sent through that encrypted tunnel.

2.3.6 WPS

WPS makes network connection easier. It is typically found on SOHO equipment and may allow a user to connect by pressing a physical button on the AP rather than entering a password. It is available only on WPA-encrypted networks. Modern versions also allow a 6-digit pin, which inherently bypasses the network password requirements. Disable WPS completely on any wireless equipment used for business because it is not secure.

2.3.7 Endpoint security

Every entry point into a wireless network is a potential attack vector, so securing every endpoint helps mitigate risk. Mobile device management (MDM) software can identify mobile-device users and configure and push Wi-Fi, VPN, and authentication-token settings to devices.

General endpoint-security recommendations are in ITSP.70.012, Guidance for Hardening Microsoft Windows 10 Enterprise. General mobile-security information is in ITSAP.00.001, Using Your Mobile Device Securely. Securing organizational BYOD devices through both policy and technical controls helps secure Wi-Fi.

2.3.8 Physical security

Physical security is as important as cyber security. It reduces the chance of someone resetting devices and connecting with default credentials, connecting to the wired network through wireless equipment, or connecting to wireless equipment and stealing credentials. A factory-reset device may expose an entire subnetwork to anyone connecting to its default network, for example where wireless devices or controllers are configured for trunking.

An attacker may place a network-tapping device between a network and a wireless or wired device. Such products are readily available online and allow access to network traffic as a person-in-the-middle attack (PITMA). They can also inject malicious code or websites into in-transit traffic, or give attackers remote access through a reverse VPN tunnel. Protect wireless infrastructure against physical access both to wireless components, such as Wi-Fi-connected IoT lightbulbs, and to components that bridge back into the wired network.

2.3.9 Wireless intrusion detection systems (WIDS)

Wireless intrusion detection systems (WIDS) and wireless intrusion prevention systems (WIPS) detect and possibly mitigate active attacks carried out through radio frequency (RF). Combined with wired-network tools and protections, RF monitoring helps secure wireless infrastructure.

One use is finding and deactivating rogue APs connected to the wired network. These APs have not been authorized and provisioned by the organization. They can create security problems by using poor or no encryption and authentication, reducing the organization’s visibility into which devices are connected and where. WIDS or WIPS can reduce how long rogue APs remain online; without them, the APs could go unnoticed indefinitely.

Some systems are integrated into APs and use their radios for both serving clients and monitoring RF as sensors. This dual use may reduce user time or bandwidth because a radio can be in only one mode at a time: monitor mode, or sending and receiving as an AP.

2.4 Training based

Training should be mandatory for new and existing employees so new threats and policy changes are communicated. Everyone using the wireless network should understand how to identify spoofed networks; how the organization’s Wi-Fi networks differ and why; which uses are allowed on each SSID and VLAN segment; how to connect correctly; how and to whom to report wireless security incidents; and how to obtain support.

2.4.1 General IT training

General IT training provides a foundation for wireless-device security, improves cyber-security practice at work, and raises awareness of personal cyber security. Topics should include available systems, data classes, the data lifecycle, user permissions, and policies for Wi-Fi and network resources.

Users should have playbooks and procedures for interacting securely with systems and data. Review these procedures regularly and update them when structure or software changes.

2.4.2 Device use

Train users on wireless standards and device use. Showing users how to secure their own devices can improve workplace culture and security. Hands-on sessions demonstrating settings changes add variety and engage visual learners.

2.4.3 Wi-Fi security courses

Online security courses can improve general Wi-Fi security knowledge. Select courses designed for average users. Training should cover best practices for unencrypted and public Wi-Fi, VPNs, and mobile devices, as well as signs that a device has been compromised and steps to address the issue.

3. Additional considerations

3.1 Legal implications

Consider the legal implications of policies and requirements before implementing them; the publication is not legal advice. Seek a lawyer to ensure compliance with Canadian laws. Personal equipment, including BYOD or home equipment, may have legal implications. When hiring a penetration tester, set boundaries, limit the scope to specific areas, and verify trustworthiness through industry reputation and references.

3.2 Increased technical support

Implementing the technical controls described requires additional technical support. Controls may prevent users from working as they are accustomed to, and devices may need extra steps or configuration. Protecting data is necessary, but the organization also needs resources to support users.

3.3 Availability

Without available authentication or network infrastructure, users cannot access needed resources. Consider high availability and disaster recovery for critical infrastructure. Multiple APs can provide staggered coverage in nearby areas during an outage.

Wireless signals are subject to jamming, so availability cannot be guaranteed. A robust wired network, the ability to plug in critical devices, and segregation of wired and wireless networks are important. This can allow wireless attacks to be isolated from, and the wireless network disconnected from, the wired network if needed.

4. Summary

Organizations need appropriate Wi-Fi policies, technical controls that enforce those policies, and staff training. The wireless landscape is growing daily as more smart-enabled devices include Wi-Fi, and the threat landscape has never been larger. Securing the network and understanding the threats helps protect a business environment for the future.

5. Supporting content

5.1 Abbreviations

AD: Active Directory
AES: Advanced Encryption Standard
AP: Access Point
BYOD: Bring Your Own Device
CCCS: Canadian Centre for Cyber Security
CCMP: Cipher Block Chaining Message Authentication Code Protocol
CRC32: Cyclic Redundancy Check
CSE: Communications Security Establishment
DDoS: Distributed Denial of Service
EAP: Extensible Authentication Protocol
GC: Government of Canada
HIPAA: Health Insurance Portability and Accountability Act
IIROC: Investment Industry Regulatory Organization of Canada
IoT: Internet of Things
IT: Information Technology
ITS: Information Technology Security
LEAP: Lightweight Extensible Authentication Protocol
MFDA: Mutual Fund Dealers Association
OS: Operating System
PCI DSS: Payment Card Industry Data Security Standard
PEAP: Protected Extensible Authentication Protocol
PEAP-MS-CHAP: PEAP Microsoft Challenge Handshake Authentication Protocol
PI: Personal Information
PITMA: Person-In-The-Middle-Attack
PSK: Pre-Shared Key
RADIUS: Remote Authentication Dial-In User Service
RBAC: Role-Based Access Control
RC4: Rivest Cipher 4
RF: Radio Frequency
SMB: Small Medium Business
SOHO: Small Office Home Office
SSID: Service Set Identifier
SSO: Single-Sign On
TKIP: Temporal Key Integrity Protocol
TLS: Transport Layer Security
VLAN: Virtual Local Area Network
VPN: Virtual Private Network
WEP: Wired Equivalent Privacy
WIDS: Wireless Intrusion Detection System
WIPS: Wireless Intrusion Prevention System
WPA: Wi-Fi Protected Access
WPS: Wi-Fi Protected Setup

5.2 Glossary

Authentication: A process or measure used to identify a user’s identity.
BYOD: Employees use their own devices for business purposes; organizations may cover some of the cost. Because the organization does not own the device, it has little control over the security controls implemented on it.
Classified information: A Government of Canada label for specific sensitive data whose compromise could harm the national interest, such as national defence, relationships with other countries, or economic interests.
Confidentiality: The ability to protect sensitive information from access by unauthorized people.
DDoS attack: An attack in which multiple compromised systems attack one target. The flood of incoming messages forces the target to shut down and denies service to legitimate users.
Encryption: Converting information from one form to another to hide its content and prevent unauthorized access.
Integrity: The ability to protect information from unintended modification or deletion, and to help determine whether information is what it claims to be. Integrity also applies to business processes, software application logic, hardware, and personnel.
IoT: A network of everyday web-enabled devices capable of connecting and exchanging information with one another.
Least privilege: Giving an individual only the privileges essential to authorized tasks. This limits damage from accidental, incorrect, or unauthorized use of an information system.
Personal information (PI): Information about an identifiable individual recorded in any form.
Threat: Any potential event or act, deliberate or accidental, or natural hazard that could compromise IT assets and information.
Vulnerability: A flaw or weakness in the design or implementation of an information system or its environment that a threat actor could exploit to adversely affect an organization’s assets or operations.
Wi-Fi: Wireless technology that connects devices such as laptops and smartphones to the Internet, using radio waves and a wireless router instead of a physical wired connection.

5.3 References

Canadian Centre for Cyber Security, ITSP.40.062, Guidance on Securely Configuring Network Protocols, October 2020.
Canadian Centre for Cyber Security, ITSP.40.111, Cryptographic Algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B Information, August 2016.
Cnet, “WeWork’s weak Wi-Fi security leaves sensitive documents exposed,” September 2019.
IoT World Today, “IoT Cyberattacks Escalate in 2021, According to Kaspersky,” September 2021.
Threat Post, “Thousands of university Wi-Fi networks expose log-in credentials,” September 2021.
Canadian Centre for Cyber Security, ITSG-33, IT Security Risk Management: A Lifecycle Approach, November 2018.
Canadian Centre for Cyber Security, ITSG-38, Network Security Zoning – Design Considerations for Placement of Services within Zones, May 2009.
Canadian Centre for Cyber Security, ITSAP.30.032, Best Practices for Passphrases and Passwords, September 2019.
Canadian Centre for Cyber Security, ITSP.70.012, Guidance for Hardening Microsoft Windows 10 Enterprise, March 2019.
Canadian Centre for Cyber Security, ITSAP.00.001, Using Your Mobile Device Securely, December 2020.

Résumé du cours