6.3Wireless security settings on a home router

Because Wi-Fi is radio, unlike wired networks it must be protected on the assumption that "anyone nearby can attempt to receive it." A home router's security settings look daunting, but the essentials are two: "which encryption standard to choose" and "how to distribute the key." This section covers the generations of wireless encryption—WPA/WPA2/WPA3—the two modes of home-oriented Personal (PSK) and enterprise-oriented Enterprise (802.1X/RADIUS), and why the old WEP and WPA (TKIP) still offered as options should be avoided—framed as the basic judgment of "which to choose for this environment."

6.3.1The WPA/WPA2/WPA3 generations

• WPA2 was the long-standing standard, using the strong cipher AES/CCMP. Still widely used, it is an acceptable safe minimum on a home router. The TKIP used by the original WPA is already weak and deprecated.
• WPA3 is the newest generation, adopting SAE for key exchange to resist password-guessing attacks, and mandating PMF (protected management frames) for greater safety. When all devices support it, choosing WPA3 is best.
• The strength order is WPA (TKIP) < WPA2 (AES) < WPA3 (SAE). When old devices are mixed and you cannot standardize on WPA3, the next-best is a WPA2/WPA3 mixed (transition) mode—and at minimum avoid WEP and the original WPA.

6.3.2Personal vs. Enterprise

• Personal (PSK: pre-shared key) uses one common password (a pre-shared key) shared by everyone. Suited to homes and small offices and easy to set up, but anyone who knows the key can connect, and if the key leaks it must be changed for everyone.
• Enterprise (802.1X/RADIUS) authenticates each user with an individual ID/password (or certificate). It works with a RADIUS server and authenticates each person via 802.1X. Because it can track who connected and when, and disable just one leaver, it enables per-user control and suits enterprises.

Suppose a small cafe owner asks: "the shop Wi-Fi kept dropping so I bought a new router. How should I set the security?" First, the choice of encryption standard. The settings screen may list WEP, WPA, WPA2, and WPA3, but WEP and the original WPA (TKIP) are already broken and must not be chosen. If staff and customer devices are fairly new, choose WPA3; if older devices are mixed in, WPA2 (AES) or a WPA2/WPA3 transition mode is reasonable. Next, the choice of mode. In a small environment like a cafe where you do not need to manage users one by one and a shared password suffices, Personal (PSK) is appropriate. Thinking "Enterprise is what big companies use, so it must be better—let us deploy it in the shop" is overkill: Enterprise requires setting up and operating a RADIUS server, too heavy for a cafe. On the other hand, if the person were a mid-size office that "wants to record access per employee and disable just a leaver's account," the answer flips to Enterprise with per-user authentication via 802.1X. So the trick in wireless security settings is to judge along two separate axes: "newer is better (lean toward WPA3 for encryption)" and "choose by scale and management needs (Personal or Enterprise)." And the one non-negotiable principle throughout: do not use the old methods WEP or the original WPA/TKIP, even if they remain as options.

6.3.3Section summary

• Cipher strength: WEP < WPA (TKIP) < WPA2 (AES) < WPA3 (SAE, PMF mandatory). WEP and the original WPA/TKIP are deprecated—choose WPA2 or newer
• Personal (PSK) uses one shared pre-shared key for homes/SOHO; Enterprise (802.1X/RADIUS) authenticates per user for enterprises
• Decide along two separate axes: "use a newer encryption generation (lean WPA3)" and "choose by scale (Personal or Enterprise)"