2.4Secure access and SoHo wireless

To protect the "entrances" to a network, you need mechanisms that screen traffic and mechanisms that admit only the right party. This section covers the basics of secure access: the ACL that permits/denies traffic, the firewall that controls by tracking state, the VPN that securely connects remote sites and home workers, and NAC that verifies a device's health before connection. Alongside, as essentials of securing wireless in small offices and homes (SoHo), it takes up the handling of the encryption standard (WPA2/WPA3), MAC filtering, and the SSID (wireless name). What matters here is telling whether each is a primary defense or merely a supplement. Mistaking a supplementary measure for a primary defense leads to a dangerous misunderstanding.

2.4.1Secure access: ACL, firewall, VPN, and NAC

• An ACL (access control list) is a list of rules that permit or deny traffic by conditions such as source/destination address and port. On routers and switches it screens "who may pass to where"—a simple but fundamental gate.
• A firewall inspects traffic at the network boundary and blocks what violates policy. A stateful firewall in particular tracks the state of established connections, admitting only the return of communication initiated from inside—controlling ingress/egress more intelligently than an ACL alone.
• A VPN (virtual private network) creates an encrypted tunnel over a public network like the internet to securely connect remote sites or home workers (using IPsec or TLS). By encrypting the path, its content is hard to read even if eavesdropped en route.
• NAC (network access control) checks a device's posture (OS and patch state, presence of antivirus, etc.) before it connects to the network, and restricts or quarantines devices that do not meet the conditions. Picture it as a "health check before entry."

2.4.2Securing SoHo wireless: encryption standard, SSID, and MAC filtering

• The encryption standard is the primary defense for wireless. Currently WPA3 is strongest, followed by WPA2. Old WEP and WPA (original) are easily cracked and must not be used. Strong encryption with a sufficiently long passphrase is the core of SoHo wireless security.
• The SSID (wireless network name) is the name of the Wi-Fi. Even hiding the SSID (stealth) does not make it a strong defense on its own, because the radio itself is emitted and can be easily found with a dedicated tool. Understand that hiding the name is a supplement at the level of a "token gesture."
• MAC filtering permits only devices with allowed MAC addresses to connect. But a MAC address is easily spoofed—by observing the radio one can steal and impersonate a legitimate MAC—so this too is weak on its own and only a supplement. It is no substitute for the encryption standard.

Suppose you are consulted about a small office's Wi-Fi: "it feels like an unknown device is sometimes connected." Asking about the setup, you learn the encryption is still old WEP, and instead they believe they are "doubly protected" by hiding the SSID and restricting allowed devices with MAC filtering. The correct introductory-level call here is to see through it as "the primary defense is misplaced." Hiding the SSID does not help because the radio is emitted and easily found with a dedicated tool, and a MAC address can be stolen and impersonated by observing the radio. In other words, these two are only supplements, and while the crucial encryption standard remains the weak WEP, the communication itself can be decrypted. Therefore the top-priority action is to raise the encryption to WPA2 (ideally WPA3) and set a sufficiently long, hard-to-guess passphrase. Hiding the SSID and MAC filtering are fine to do, but it is important not to lose sight of their position as supplements that must not be relied on alone. The same thinking applies to the wired side. At the boundary between outside and internal, place a firewall to inspect ingress/egress, permit or deny allowable traffic with an ACL, tunnel home workers and inter-site links with an encrypted VPN, and check devices brought inside with NAC for patch and antivirus state before connection—layering gates of different roles is the basic form of secure access. In short, the judgment to build at the introductory stage is to correctly discern whether each technology is a "primary defense" or a "supplement," and not to neglect the primary one.

2.4.3Section summary

• An ACL permits/denies, a firewall tracks state at the boundary, a VPN encrypts the path, and NAC checks device posture before connection—layer gates of different roles
• The primary defense for SoHo wireless is the WPA2/WPA3 encryption standard; WEP and original WPA are easily cracked and must not be used
• A hidden SSID and MAC filtering are only supplements (easily spoofed/found) and are no substitute for encryption