Key takeaways
- Separate staff, guest and device networks
- Prefer WPA3, and individual sign-ins over one shared password
- Change default admin credentials and turn off WPS
- Keep firmware current and manage access points centrally
Separate your networks
The most important Wi-Fi control is segmentation. A visitor’s phone, a smart TV or a door camera should never share a network with the computers that hold client files.
- Staff network: managed company devices with access to business systems
- Guest network: internet only, isolated from everything else, with client isolation so guests cannot see each other
- Device network: printers, cameras, TVs and other smart devices, limited to the services they need
- Payment or clinical devices on their own segment where compliance calls for it
Encryption and sign-in
WPA3 is the current Wi-Fi security standard and resists the offline password-guessing attacks that weaken WPA2. Where older devices need it, a WPA2 and WPA3 transition mode keeps them connected while newer devices use WPA3.
A single shared password for all staff is the weak point in most small offices: it leaks, it ends up on sticky notes and former employees still know it. WPA2 or WPA3 Enterprise gives each person their own sign-in, often tied to their Microsoft 365 account, so removing someone’s access becomes part of offboarding.
Settings small offices miss
- Default admin usernames and passwords left on access points and the router
- WPS left on, which allows easy PIN attacks
- Old WEP or TKIP settings kept for one legacy device
- Firmware not updated since installation
- Remote management open to the internet
- Guest passwords that never change
- Consumer routers used in place of business access points
Management and monitoring
Business-grade access points are managed from one console, which keeps settings consistent across every unit and site, rolls out firmware and shows which devices are connected. That visibility is what lets you spot an unknown device, a rogue access point or a network that has slowed to a crawl.
How we help
The managed network covers your firewall, switches, routers, access points and Wi-Fi, with network segmentation and remote access and VPN management, all administered remotely. We design guest and device networks so visitors and smart devices stay away from business systems, and we troubleshoot network problems with your internet providers when the cause is upstream.
Sources
Information on this page is general and is not legal or compliance advice.