Basic Network Security Concepts · Topic 5 of 7

Securing a SoHo Wireless Network

Learn how to secure a small office or home wireless network with strong encryption, a sensible SSID, careful use of MAC filtering and other simple steps.

4 min

In a nutshell

WEP is broken, and WPA3 is the strongest current standard.
WPA2 with AES is a good choice when WPA3 is not available.
Personal mode uses a shared password, and enterprise mode uses an authentication server.

What it is

A SoHo network is a small office or home network, usually built around one wireless router.

These networks often run with factory settings, which makes them easy targets. Wireless signals also travel through walls, so people outside the building can try to join.

This page covers the main settings that protect a wireless network: encryption, the SSID, and MAC address filtering.

How it works

Strong encryption is the setting that matters most, and the others only add small extra steps.

Encryption standards

Encryption makes wireless traffic unreadable to anyone who captures it. The standards have improved over time.

Standard	Status	Notes
WEP	Broken, do not use	Weak and easy to crack in minutes
WPA	Outdated	Replaced WEP as a quick fix, uses TKIP
WPA2	Widely used, still acceptable	Uses AES, with the CCMP method
WPA3	Newest and strongest	Better protection against password guessing and stronger overall security

The best choice is WPA3 if every device supports it, and WPA2 with AES otherwise. Do not choose TKIP or WEP.

WPA2 and WPA3 each come in two modes:

Personal uses one shared password, called a pre shared key. It suits homes and small offices.
Enterprise uses an authentication server, normally with RADIUS, so each user logs in with their own credentials. It suits larger organisations.

With a pre shared key, the strength of the password matters. Use a long passphrase that is hard to guess.

The SSID

The SSID (service set identifier) is the name of the wireless network. It is what people see in the list of available networks.

Good practice for the SSID:

change the default name, because it can reveal the router brand and model
avoid names that give away personal or business details
do not treat hiding the SSID as real security, because the name can still be found by tools that watch wireless traffic

Hiding the SSID only stops casual browsing. The encryption is what protects the network.

MAC address filtering

MAC address filtering lets the router accept only devices whose MAC addresses are on an allowed list. It can also block listed addresses.

It sounds strong but is weak. An attacker can capture the MAC addresses of allowed devices from the air, and then copy one by spoofing. The list is also a chore to keep up to date.

Treat MAC filtering as a minor extra layer, never as a replacement for strong encryption.

Other basic settings

A secure SoHo router also needs:

a new administrator password, because default logins are well known
firmware updates, to fix known flaws
WPS turned off, because the push button or PIN feature can weaken protection
remote management off unless it is truly needed
a guest network for visitors, kept apart from the main network
the router firewall left on

Router settings (names vary by maker)
Security mode: WPA2 Personal or WPA3 Personal
Encryption: AES
SSID: a new name that gives nothing away
Wireless password: a long passphrase
Router admin password: changed from the default

The names of these menus differ between router makers, so read the manual for the exact labels.

What to remember for the exam

Seven facts cover most questions on this topic.

WEP is broken, and WPA3 is the strongest current standard.
WPA2 with AES is a good choice when WPA3 is not available.
Personal mode uses a shared password, and enterprise mode uses an authentication server.
Change the default SSID and the default router password.
Hiding the SSID is not real security.
MAC address filtering is weak because MAC addresses can be spoofed.
Update the router firmware and turn off WPS.

Exam tip

When asked for the single best wireless protection, choose the strongest encryption, not hiding the SSID or MAC filtering.

Common mistakes

These four errors are common.

Relying on a hidden SSID. The name can still be discovered, so it adds almost nothing.

Trusting MAC filtering. Anyone who copies an allowed address can pass the filter.

Leaving the default router login. Attackers know the default accounts for common routers.

Choosing an old standard for compatibility. Using WEP or TKIP to support an old device weakens the whole network, so replace the device or use a separate network for it.

Watch out

An open wireless network with no password sends traffic that anyone nearby can read. Avoid using one for sensitive work.

Check yourself

Work through these three questions.

Which wireless standard is broken and should never be used?
WEP. It is weak and easy to crack.
Why is MAC address filtering not a strong control?
An attacker can capture an allowed MAC address and copy it by spoofing. It should only be a minor extra layer.
Is hiding the SSID a reliable way to secure a network?
No. The name can still be found, so strong encryption is what actually protects the network.

Topic 5 of 7 in Basic Network Security Concepts

Test yourself on Basic Network Security Concepts

The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.