Securing Wi-Fi

15 min In Progress

Learning Objectives

Rank WEP, WPA2, and WPA3 by security strength
Know why WPS should be disabled
Build a Wi-Fi config validator

What Actually Matters

Use WPA3 (or WPA2-AES at minimum) -- never WEP or WPA-TKIP, both are broken. Disable WPS, it's trivially brute-forced. Separate guest and internal SSIDs. For enterprise networks, use 802.1X + RADIUS instead of one shared passphrase everyone knows.

Conceptual Cisco WLC-style syntax -- reference only.

wlan SecureCorp 1 SecureCorp
 security wpa wpa2 ciphers aes
 security wpa akm 802.1x
 radius_server auth add 1 192.168.1.50 1812 ascii MyRadiusSecret

Practice — Quick Validator

Same logic as a Python check over an AP config dict.

ap = {"security": "WPA2-AES", "wps_enabled": True}

if ap["security"] in ("WEP", "WPA-TKIP"):
    print("CRITICAL: weak encryption in use")
if ap["wps_enabled"]:
    print("WARNING: WPS should be disabled")

📝 Exercise: Build a Wi-Fi Security Scorer

Write a function score_ap(ap) that starts at 100 points and deducts: 100 points if security is 'WEP', 50 points if security is 'WPA-TKIP', 20 points if wps_enabled is True, and 10 points if guest_isolated is False. Return the final score (clamped to 0 minimum) plus a verdict: 'secure' (80+), 'needs improvement' (40-79), or 'critical' (under 40).

code.py

access_points = [
    {"name": "corp-main", "security": "WPA3", "wps_enabled": False, "guest_isolated": True},
    {"name": "old-ap-lobby", "security": "WEP", "wps_enabled": True, "guest_isolated": False},
    {"name": "guest-net", "security": "WPA2-AES", "wps_enabled": True, "guest_isolated": True},
]

def score_ap(ap):
    score = 100
    if ap["security"] == "WEP":
        score -= 100
    elif ap["security"] == "WPA-TKIP":
        score -= 50
    if ap.get("wps_enabled"):
        score -= 20
    if not ap.get("guest_isolated", True):
        score -= 10
    score = max(score, 0)
    if score >= 80:
        verdict = "secure"
    elif score >= 40:
        verdict = "needs improvement"
    else:
        verdict = "critical"
    return score, verdict

for ap in access_points:
    score, verdict = score_ap(ap)
    print(f"{ap['name']}: {score}/100 -> {verdict}")

Output

← Back to Chapter