Wireless Wi-Fi networks have become an integral part of every organization’s infrastructure. From conference rooms, through open-plan offices, to warehouses and production halls — wherever mobility and flexibility are needed, Wi-Fi replaces or supplements traditional cabling. However, from a cybersecurity perspective, every access point is a potential attack vector, and every unauthorized connection poses a risk of data confidentiality breach. In this article, we comprehensively discuss what a Wi-Fi network is, what standards and frequencies it uses, how its security has evolved, and what threats await organizations that do not take wireless security seriously enough.
Definition and IEEE 802.11 Standards
Wi-Fi (Wireless Fidelity) is a family of wireless local area network (WLAN) technologies based on standards developed by the IEEE (Institute of Electrical and Electronics Engineers) under the designation 802.11. Wi-Fi enables devices such as laptops, smartphones, printers, and IP cameras to connect to the local network and the internet via radio waves, without the need for physical cables.
The 802.11 standard has undergone a long evolution, with each successive generation bringing higher throughput, better performance, and new frequency bands:
- 802.11b (1999) — the first mass-market Wi-Fi, up to 11 Mbit/s in the 2.4 GHz band. Completely obsolete today.
- 802.11a (1999) — a parallel standard operating in the 5 GHz band with throughput up to 54 Mbit/s. Shorter range but less interference.
- 802.11g (2003) — combining the advantages of both predecessors: 54 Mbit/s in the 2.4 GHz band, backward compatible with 802.11b.
- 802.11n / Wi-Fi 4 (2009) — a breakthrough: introduction of MIMO (Multiple Input, Multiple Output) technology and support for both bands (2.4 and 5 GHz), throughput up to 600 Mbit/s.
- 802.11ac / Wi-Fi 5 (2013) — focused on the 5 GHz band, with MU-MIMO (Multi-User MIMO) technology, beamforming, and throughput up to 6.9 Gbit/s (theoretically).
- 802.11ax / Wi-Fi 6 (2020) — a revolution in dense network performance, introducing OFDMA, BSS Coloring, Target Wake Time (TWT), throughput up to 9.6 Gbit/s.
- 802.11ax / Wi-Fi 6E (2021) — extending Wi-Fi 6 to the 6 GHz band, adding 1200 MHz of new, clean spectrum.
- 802.11be / Wi-Fi 7 (2024) — the latest standard with Multi-Link Operation (MLO), 320 MHz channels, 4K-QAM, and throughput up to 46 Gbit/s.
Every organization should know which standards its wireless infrastructure supports. Older access points operating only in 802.11g or 802.11n mode not only offer lower performance but also force the use of outdated security protocols.
How a Wi-Fi Network Works — Frequencies, Channels, and MIMO
Understanding the basics of how Wi-Fi works is essential for effectively securing a wireless network. At the physical level, Wi-Fi uses radio waves to transmit data between an access point (AP) and client devices.
Frequencies — 2.4 GHz, 5 GHz, and 6 GHz
Wi-Fi networks operate in three main frequency bands, each with different characteristics:
The 2.4 GHz band offers the greatest range and the best penetration through walls and obstacles. Its drawback, however, is the limited number of non-overlapping channels (only 3 in Europe: 1, 6, 11) and enormous congestion — Bluetooth devices, microwave ovens, DECT phones, and dozens of neighboring Wi-Fi networks all operate in the same band.
The 5 GHz band provides significantly higher throughput and has many more channels (up to 25 non-overlapping channels in Europe), which minimizes interference. The trade-off is shorter range and weaker penetration of physical obstacles.
The 6 GHz band (1200 MHz of new spectrum), introduced with Wi-Fi 6E, is a true revolution. It offers 59 additional 20 MHz channels (or 7 channels at 160 MHz), free from interference by older devices. From a security perspective, it is important that older devices cannot operate in the 6 GHz band, meaning that a network in this band automatically enforces WPA3 support.
Channels and Their Significance for Security
Proper channel selection affects not only performance but also security. Overlapping channels create interference that can destabilize connections, making it easier for attackers to carry out deauthentication attacks. Professional network planning tools (known as wireless site surveys) allow optimal placement of access points and channel assignment, minimizing mutual interference.
MIMO, MU-MIMO, and OFDMA
MIMO (Multiple Input, Multiple Output) technology uses multiple transmitting and receiving antennas to simultaneously transmit multiple data streams. MU-MIMO (Multi-User MIMO) extends this concept by enabling simultaneous service to multiple clients, instead of queuing their requests.
OFDMA (Orthogonal Frequency Division Multiple Access), introduced in Wi-Fi 6, divides the channel into smaller subchannels (Resource Units) that can be allocated to different devices simultaneously. As a result, even dozens of IoT devices connected to a single AP do not degrade network performance.
Wi-Fi 6, Wi-Fi 6E, and Wi-Fi 7 — What’s New from a Security Perspective
The latest generations of Wi-Fi introduce features that have a direct impact on network security.
Wi-Fi 6 (802.11ax) is not just about higher throughput. Key improvements include Target Wake Time (TWT), which allows IoT devices to sleep for longer periods (reducing the attack window), and BSS Coloring, which prevents inter-network interference, making it harder to attack connection stability. Wi-Fi 6 still supports WPA2, but full Wi-Fi 6 certification requires WPA3 support.
Wi-Fi 6E adds the 6 GHz band, where WPA3 is mandatory — older devices that only support WPA2 cannot operate in this band. This is a natural migration path to more secure protocols. Furthermore, 6 GHz offers shorter range than 2.4 GHz, which paradoxically increases security — the signal is harder to intercept from outside the building.
Wi-Fi 7 (802.11be) introduces Multi-Link Operation (MLO), which allows a device to simultaneously use multiple bands and channels. From a security perspective, MLO increases resilience against jamming attacks — if one band is jammed, transmission automatically switches to another. The 320 MHz channels and 4K-QAM modulation increase throughput, but also require correspondingly powerful encryption so that cryptography does not become a bottleneck.
Evolution of Security — from WEP to WPA3
The history of Wi-Fi security is a story of a continuous race between defenders and attackers. Each successive protocol was created in response to the breaking of the previous one.
WEP — Completely Broken
WEP (Wired Equivalent Privacy), introduced in 1997 along with the first 802.11 specification, was intended to provide a level of security comparable to a wired network. It used the RC4 cipher with 64-bit or 128-bit keys. As early as 2001, the FMS (Fluhrer, Mantin, Shamir) attack was published, which allowed breaking a WEP key within minutes. Today, breaking WEP takes literally seconds. WEP should not be used under any circumstances.
WPA — A Temporary Patch
WPA (Wi-Fi Protected Access) was introduced in 2003 as a temporary solution before the full 802.11i standard was completed. WPA used the TKIP (Temporal Key Integrity Protocol) protocol, which dynamically changed encryption keys. Although significantly more secure than WEP, TKIP also proved vulnerable to attacks (the Beck-Tews attack in 2008). WPA with TKIP is now considered obsolete.
WPA2 — The Long-Standing Standard
WPA2 (2004) is the full implementation of the 802.11i standard, using AES in CCMP (Counter Mode with CBC-MAC Protocol) mode. WPA2 was considered secure for over a decade until the KRACK (Key Reinstallation Attack) was discovered in 2017, which allowed decryption and injection of packets in WPA2 networks. KRACK exploited a vulnerability in the four-way handshake mechanism, forcing the reuse of one-time values (nonce). Although vendors released patches, the KRACK attack revealed a fundamental weakness in the protocol.
Additionally, WPA2-Personal (PSK) is vulnerable to offline dictionary attacks — an attacker captures the handshake and attempts to crack the password on their own equipment, without any further interaction with the network.
WPA3 — The Current Standard
WPA3 (2018) introduces fundamental changes:
- SAE (Simultaneous Authentication of Equals) — replaces PSK with the Dragonfly protocol, which eliminates offline dictionary attacks. Even if an attacker captures the handshake, they cannot use it for offline brute-force.
- OWE (Opportunistic Wireless Encryption) — provides encryption even on open networks (without a password), protecting against passive eavesdropping in cafes or airports.
- 192-bit Security Mode (WPA3-Enterprise) — uses a 192-bit security level compliant with CNSA (Commercial National Security Algorithm Suite), required in government and military environments.
- PMF (Protected Management Frames) — mandatory in WPA3, protects management frames (deauthentication, disassociation) from spoofing, making deauth attacks more difficult.
Attacks on Wi-Fi Networks — Techniques and Threats
Wi-Fi networks are exposed to a range of specific attacks that stem from the very nature of wireless transmission — the radio signal is accessible to anyone within range.
Evil Twin — Fake Access Point
An evil twin attack involves setting up a fake access point with an identical SSID (network name) to the legitimate corporate network. The attacker uses a stronger signal or first conducts a deauthentication attack to force victims’ devices to connect to the fake AP. From that point on, all of the victim’s network traffic passes through the attacker-controlled point, enabling the interception of login credentials, injection of malicious code, and man-in-the-middle attacks.
Deauthentication Attack
A deauth attack exploits the fact that in standards older than WPA3, deauthentication (disconnection) frames are not authenticated. The attacker sends spoofed deauth frames on behalf of the access point, forcing clients to disconnect. This attack is often used as a precursor to an evil twin (the client searches for a network after disconnection and connects to the fake AP) or simply as a denial-of-service attack. WPA3 with mandatory PMF (Protected Management Frames) effectively eliminates this vector.
KRACK — Key Reinstallation Attack
Discovered in 2017 by Mathy Vanhoef, the KRACK attack targeted a fundamental vulnerability in the WPA2 protocol. The attacker manipulated the four-way handshake process, forcing the client to reinstall an already-used encryption key with a zeroed nonce. This allowed packet decryption, and in the case of Linux and Android (which used wpa_supplicant) — installation of a zero key, which gave full access to traffic in plaintext. Although firmware and driver patches were released, many IoT devices never received updates.
PMKID Capture
The PMKID attack (discovered in 2018 by the creator of hashcat) allows capturing a PMKID hash from the first EAPOL frame without needing to wait for a full four-way handshake and without an active client on the network. The attacker sends a single association request to the AP and receives the PMKID, which can then be cracked offline. This is a faster and simpler vector than the classic WPA2 handshake capture.
Rogue Access Point
A rogue AP is an unauthorized access point connected to the corporate network. It could be a router brought in by an employee who wanted better Wi-Fi in their room, or a device deliberately placed by an attacker who gained physical access to the building. A rogue AP bypasses the firewall and all network security measures, creating an unprotected entry point into the internal LAN.
Packet Sniffing on Open Networks
On networks without encryption (or with broken WEP), anyone within range can passively intercept all traffic using tools such as Wireshark or tcpdump in monitor mode. Even on encrypted networks, if the attacker knows the PSK password, they can decrypt other clients’ traffic (in WPA2-Personal, all devices share the same encryption key).
Securing a Corporate Wi-Fi Network
Professionally securing a wireless network in an organization requires a multi-layered approach that goes far beyond setting a strong password.
WPA3-Enterprise with 802.1X and RADIUS
In a corporate environment, the standard is WPA3-Enterprise with 802.1X authentication. Instead of a shared password (PSK) used by all employees, each user logs in with their own credentials (username/password or a digital certificate). The RADIUS (Remote Authentication Dial-In User Service) server verifies the user’s identity, and upon successful authentication, generates unique encryption keys for the given session.
The advantages of this solution are fundamental: when an employee leaves, there is no need to change the Wi-Fi password on all devices — simply disabling their account is sufficient. Each user has unique encryption keys, so they cannot eavesdrop on other users’ traffic. Detailed auditing is also possible — it is known who connected to the network, when, and from where.
Network Segmentation — VLANs and Separate SSIDs
Proper wireless architecture requires at minimum three separate networks (SSIDs), each assigned to a distinct VLAN:
- Corporate network — for employees, with WPA3-Enterprise and 802.1X, full access to internal resources.
- Guest network — for visitors and contractors, with restricted access to the internet only, isolated from the internal network.
- IoT network — for Internet of Things devices (printers, cameras, sensors), which often have limited security capabilities and should not have access to the production network.
Segmentation using VLANs ensures that compromising one network (e.g., the guest network) does not give the attacker access to corporate resources.
WIDS/WIPS — Wireless Threat Detection
WIDS (Wireless Intrusion Detection System) and WIPS (Wireless Intrusion Prevention System) are systems that monitor the radio environment for anomalies and threats. A professional WIDS/WIPS can detect rogue APs (by comparing the list of detected devices against authorized ones), identify evil twin attacks (based on analysis of MAC addresses and signal parameters), alert on deauthentication attacks (by detecting mass deauth frames), and identify clients connecting to fake networks.
Advanced WIPS systems can automatically neutralize threats — for example, by sending deauth frames to clients connected to a rogue AP to disconnect them from the fake network.
Additional Layers of Protection
The above mechanisms should be supplemented with regular firmware updates for access points and WLAN controllers, disabling support for older standards (802.11b/g) and outdated protocols (WEP, WPA-TKIP), implementation of NAC (Network Access Control) to verify the security posture of devices before granting network access, monitoring and logging wireless events in a central SIEM system, and limiting the transmit power of APs so that the signal does not leak beyond the organization’s buildings.
It is worth emphasizing that hiding the SSID does not constitute a real security measure — any Wi-Fi auditing tool will detect a hidden network within seconds.
Wi-Fi Security Audit
A regular wireless security audit is a key element in maintaining a secure infrastructure. A professional Wi-Fi audit covers several areas.
Wireless Site Survey
A physical inspection of the radio environment using spectrum analyzers and professional measurement tools. The goal is to identify coverage range, dead zones, interference, and to verify that the corporate signal does not extend beyond the organization’s boundaries.
Wi-Fi Penetration Testing
Wireless network penetration testing is a controlled attack simulation that includes attempts to break authentication (PSK brute-force, attacks on 802.1X), testing resilience against evil twin and rogue AP, verifying segmentation (whether it is possible to reach the corporate network from the guest network), checking the effectiveness of WIDS/WIPS, and attempting to intercept and decrypt traffic. At nFlo, we have completed over 500 security projects, including numerous wireless network audits for organizations in the financial, industrial, and public sectors.
Configuration Verification
An audit of access point, controller, and RADIUS server configurations, including verification of encryption protocols in use, password policies, access control rules, firmware currency, and compliance with the organization’s security policy.
Continuous Monitoring
A one-time audit is not enough. Effective protection requires continuous monitoring of the wireless environment. The SOC (Security Operations Center) team should have visibility into WIDS/WIPS alerts and respond to wireless incidents in real time. nFlo supports over 200 clients in continuous security monitoring, including wireless infrastructure protection.
Wi-Fi in the Context of Compliance — PCI DSS and NIS2
Wireless network security is not only a technical matter but also a regulatory one. Two key frameworks set specific requirements for Wi-Fi.
PCI DSS (Payment Card Industry Data Security Standard)
Organizations processing payment card data must meet stringent PCI DSS requirements regarding wireless networks. Requirement 1 mandates network segmentation — the cardholder data environment (CDE) must be isolated from the wireless network. Requirement 2 prohibits the use of default passwords and configurations — this also applies to access points. Requirement 4 requires strong encryption of data in transit — in practice, a minimum of WPA2-Enterprise with AES. Requirement 11.1 explicitly mandates quarterly scanning for unauthorized access points (rogue APs). Requirement 11.2 requires regular vulnerability scans, and Requirement 11.3 requires penetration testing, including the wireless network.
NIS2 (Network and Information Security Directive)
The NIS2 directive, in force in the European Union since October 2024, imposes on essential and important entities (including sectors: energy, transport, finance, health, digital infrastructure) the obligation to implement appropriate cybersecurity risk management measures. In the context of Wi-Fi, this means a mandatory risk analysis covering wireless infrastructure, implementation of security measures proportional to the identified risk (WPA3-Enterprise, segmentation, WIDS/WIPS), continuous monitoring and incident detection (including wireless), incident response procedures related to Wi-Fi security breaches, and regular security audits and testing.
Violation of NIS2 requirements can result in financial penalties of up to 10 million euros or 2% of annual turnover — making investment in wireless security not an optional add-on, but a business necessity.
Best Practices — Summary for Organizations
Effectively securing a corporate Wi-Fi network requires a systematic approach. At the infrastructure level, key measures include deploying WPA3-Enterprise with 802.1X and RADIUS, segmentation into separate VLANs (employees, guests, IoT), deployment of WIDS/WIPS for rogue AP and attack detection, regular firmware updates for all wireless components, and disabling support for outdated standards and protocols.
At the security policy level, the organization should define an acceptable use policy for the wireless network, device onboarding and offboarding procedures, configuration requirements for client devices (e.g., mandatory Wi-Fi profile with a certificate), and rules for using Wi-Fi outside the office (mandatory VPN).
At the audit and monitoring level, essential measures include regular wireless network penetration testing (at least once a year), quarterly scanning for rogue APs, continuous monitoring by the SOC team, and configuration reviews after every significant change in the infrastructure.
Wi-Fi network security is not a one-time deployment but a continuous process requiring knowledge, appropriate tools, and regular testing. In a world where attacks on wireless infrastructure are becoming increasingly sophisticated, a professional approach to Wi-Fi protection is a prerequisite for the secure operation of every organization.
Related terms
Our services
Frequently asked questions
What is a Wi-Fi network?
Wi-Fi (Wireless Fidelity) is a wireless local area network (WLAN) based on IEEE 802.11 standards, enabling devices to connect to the internet and a local network via radio waves (2.4 GHz, 5 GHz, 6 GHz). The latest standards are Wi-Fi 6E and Wi-Fi 7.
What are the most common attacks on Wi-Fi networks?
Evil twin (a fake AP impersonating corporate Wi-Fi), deauthentication attack (disconnecting clients), KRACK (a WPA2 vulnerability), PMKID capture (capturing a WPA2 hash), rogue AP (an unauthorized access point), and packet sniffing on open networks.
WPA2 vs WPA3 — what are the differences?
WPA3 introduces SAE (Simultaneous Authentication of Equals) instead of PSK, eliminating offline dictionary attacks. It adds OWE (encryption on open networks), a 192-bit security mode for enterprise, and protection against KRACK attacks.
How to secure a corporate Wi-Fi network?
WPA3-Enterprise with 802.1X (RADIUS), separate SSIDs for employees/guests/IoT, WIDS/WIPS (rogue AP detection), VLAN segmentation, hiding the SSID is a myth — better approaches include: strong passwords, monitoring, regular wireless security audits, and penetration testing.
