- Network support: Ensure that your network infrastructure, including access points and controllers, supports WPA3 and (optionally) optional OWE for open networks. Although most new network devices are WPA3 compatible, older hardware may need to be updated or replaced. If you want to use an optional function in WPA3, do some research and consider all the requirements for that feature. For example, to use 192-bit security in Enterprise Mode, your RADIUS server must support certain EAP methods and you must use EAP-TLS with server and client certificates for 802.1X authentication. The wireless controller may provide support, or you may need to use an external RADIUS server.
- Client support: Make sure the devices connecting to your network support WPA3. While most modern smartphones, tablets, and laptops are WPA3 compatible, some expensive devices may need to be updated or replaced. If not all client devices will support WPA3, you can start the network in WPA2/WPA3 mixed mode.
- Software updates: Even if your network and client hardware may already support WPA3 and OWE, check for firmware and driver updates in case additional WPA3 features are released to further support the standard. Updates may add additional usage options.
- Configuration: You must configure your access controller/points to enable the use of WPA3 and/or OWE encryption and authentication protocols. Not all network gear will support the exact same options to use either.
Tips for using WPA3
Here are some tips to maximize the benefits of WPA3 on your business network:
- Use WPA2/WPA3 mixed mode: Unless you are working with a small and controlled network where you can ensure that all clients will support WPA3, you will probably want to support WPA2 clients. This is possible with WPA2/WPA3 hybrid or switch modes. Although it doesn’t make sense to be very efficient, it will still be possible for old clients to connect.
- Understand different deployment configurations: When you configure gear that supports WPA3, you’ll get a lot of new options to deploy in terms of security. This is something that should be considered even before deployment, when choosing your equipment, so you make sure it will support the methods you want. In WPA3-Personal, you can find options like Hash-to-Element (H2E) for password generation or optionally Fast Transition enabled. Another example: Some network gear may support WPA3-only SSIDs broadcasting in the 6GHz band, while others may have WPA2/WPA3 mixed-mode support for the new band. In WPA3-Enterprise, you may see support for different implementation options, such as 802.1X-SHA256 AES CCMP 128, GCMP128 SuiteB 1x, and GCMP256 SuiteB 192 bit. If you have a preference, make sure the gear you choose supports it. Do your research on each supported configuration to understand what works best for your wireless LAN and clients.
- Use mixed mode for OWE: If you want to open OWE for Wi-Fi Enhanced Open connection, consider mixed or transition mode. That way, the network accepts both traditional unencrypted connections from old clients and encrypted connections from new clients that support OWE.
- Use strong passwords everywhere: Even with the enhanced security of WPA3, weak passwords will remain vulnerable. Use complex, hard-to-guess Wi-Fi passwords and if you’re using enterprise mode with user passwords, use user passwords protected by a RADIUS server. And, with all these innovative encryption methods, don’t forget about good old-fashioned vulnerabilities, like weak passwords on network components.
- Always update firmware and drivers: Keep your infrastructure firmware up to date to ensure you have the latest security patches and enhancements, especially WPA3 updates. The same idea applies to client devices; new driver software may add support for better or newer WPA3 functionality.
- Monitor rogue, misconfigured, and disruptive APs: You can set up the best Wi-Fi security and military-grade encryption on your APs, but a rogue AP connected to the network by an employee or an attacker can open a whole loophole. Or the authorized AP may not be properly configured. So, enable any rogue AP detection or monitoring you have.
Remember, there are significant improvements in WPA3, addressing vulnerabilities and introducing new security features. However, there are many requirements that you should consider without affecting other features of Wi-Fi 6. The effort may be worth using more secure encryption and transferring secrets in personal mode or getting 192-bit security in business mode. Also, don’t forget that if you want to use Wi-Fi Enhanced Open on public Wi-Fi, you need to look for network tools and clients that actually support it.
Successful implementation of WPA3 requires updated network infrastructure, client compatibility, and careful configuration. Using mixed or alternating methods of WPA2/WPA3 and OWE, enforcing strong passwords, and keeping firmware and drivers up-to-date are important tips to maximize the benefits of WPA3 and ensure strong Wi-Fi security.
Source link