Wireless Security Options

There are several options available for securing your wireless network. WPA Enterprise is the option that provides both user authentication (which allows you to control who accesses your network) and strong cryptography (which protects your network traffic).

Wired Equivalent Privacy

Wired Equivalent Privacy (WEP) was the initial attempt at providing some form of security to Wi-Fi networks. It uses encryption based on the RC4 algorithm in a way that makes it easy to recover the network encryption key, and thus acquire unauthorized access to the network. The security of WEP is based on a single, shared encryption key of either 40 or 128 bits in length. A flaw in the WEP design can allow an attacker to compromise a WEP-protected network in minutes.

The use of WEP has been deprecated. It has been supplanted by two newer protocols: WPA Personal and WPA Enterprise.

WPA Personal

WPA Personal uses a single password shared among all users. Any users in possession of this password can access the network and have their communications protected by encryption using a key derived from the password. One advantage to WPA Personal is that it is simple to set up and use: all network access points are configured to use the same password, and that same password is then distributed to all users, who need only the password in order to access the network. Another advantage is that WPA Personal does not require any back-end intrastructure (i.e., a RADIUS server such as Elektron). Disadvantages include the fact that there is no user management; every user shares the same password, so when one user leaves an organization, the password must be changed on all access points and the new password distributed to all remaining users. What's more, every user shares encryption keys derived from the same password, making it possible for attackers to compromise poorly selected passwords.

WPA Enterprise

The strongest method of Wi-Fi security available today is WPA Enterprise. Like the enterprise version of WEP, users are authenticated using a RADIUS server. This gives network administrators fine-grained control over who can access the network. Each user receives their own unique, cryptographically generated encryption key, making the work of an attacker much more difficult. Finally, all authentication information is protected in an encrypted channel, keeping all usernames and passwords out of the reach of attackers.

Wi-Fi Security Comparison

Feature	WEP	WPA Personal	WPA Enterprise
Wide Industry Adoption
Strong Encryption
Per-User Encryption Keys
Fine-Grained User Authentication