Module 5 · 5.3

English

Nederlands English Deutsch

Wifi, working from home and on the road

Module 5: Devices, software and network · Reading time: 11 minutes

Learning objective: After this lesson, you can set up wifi securely at the office and at home, separate smart devices and guests from your work network, and work safely on the road, including what a VPN does and doesn't do for you.
Key concepts: router, admin password, WPA2, WPA3, SAE, transition mode, WPS, UPnP, guest network, public wifi, fake hotspot, https, VPN, phone hotspot

The router is your front door

Everything that connects your office or home workspace to the internet goes through the router (often in one box together with your provider's modem). It does three things: it connects your network to the internet, it blocks traffic from outside that you didn't request (the firewall), and it usually also broadcasts the wifi network.

A router is rarely looked at again once the engineer has left. That's why factory settings are often still in place. Four things to sort out straight away:

Change the admin password. This is the password for the router's settings page, not the wifi password. Default passwords are often known for a particular brand or series. Use a long, unique password from your password manager.
Turn off remote management, unless your provider genuinely needs it. That way, the settings page is only reachable from your own network.
Turn off UPnP if you don't need it. UPnP lets any device on your network open a port in the firewall by itself, including a camera with a vulnerability. The National Cyber Security Centre (NCSC) recommends turning it off.
Update the firmware or check that your provider does this automatically (lesson 5.1). If your router no longer gets updates, replace it.

WPA2 and WPA3: how your wifi is encrypted

Wifi travels through the air. Anyone nearby can pick up the signals. That's why it's encrypted. The standard for this is managed by the Wi-Fi Alliance.

Mode	Verdict	Explanation
Open (no password)	Not for your business	Anyone can join and, without https, read along.
WEP, WPA (the first version), TKIP	Insecure	Outdated and cracked. If you see this, replace the router or change the setting.
WPA2-Personal (AES)	Sufficient, with a long password	Anyone who captures one device's connection can then keep trying passwords endlessly at home, without staying nearby. A short or predictable wifi password falls quickly.
WPA3-Personal	Best choice	Uses SAE instead of the old shared-key system. According to the Wi-Fi Alliance, an attacker can no longer try passwords offline: every guess requires a new attempt against the router itself. And even if someone learns the password later, they can't decrypt traffic captured earlier (forward secrecy).
WPA2/WPA3 transition mode	Good as an interim step	New devices connect with WPA3, older ones with WPA2. Useful as long as you still have older devices; they will only get WPA2's level of protection.

According to the Wi-Fi Alliance, WPA3 is mandatory for devices with the Wi-Fi CERTIFIED certification, so almost every new router and phone supports it. Choose WPA3 if all your devices support it, otherwise use transition mode.

In every case, use a long wifi password, for example a passphrase of four or five separate words (lesson 2.1). It's stored in your devices anyway; you'll rarely need to type it.

WPS (Wi-Fi Protected Setup) is a button or PIN code for pairing devices easily. The PIN code variant has a well-known design flaw: because of the way the router responds, an attacker doesn't need to try a hundred million combinations but only around eleven thousand, after which they find the wifi password (CERT/CC, 2011). Turn off WPS if your router allows it.

Guest network: separating what doesn't belong together

A small office quickly ends up with devices of very different trustworthiness on the same network: the laptops with the accounts, the NAS with client files, but also visitors' phones, a smart TV in the waiting area, a thermostat and a few cameras. If they're all on one network, a hacked camera can talk directly to the NAS.

That's why you create a guest network: a second wifi network with its own name and password, which does provide internet access but no access to the devices on your main network. Almost every router can do this. Put the following on it:

visitors and their phones;
smart devices: TV, thermostat, doorbell, speaker, and cameras where possible. The National Cyber Security Centre (NCSC) explicitly recommends this;
personal devices of employees, if they don't need access to business data.

After setting it up, check that it works: from a phone on the guest network, you shouldn't be able to find the printer or NAS.

Working from home

At home, you work on a network you don't manage as a business, often shared with family members, a games console and the neighbours' smart speaker appearing in the list of networks. Agree the following with your team:

the home router gets the same basic treatment: its own admin password, WPA2 or WPA3 with a long password, firmware up to date;
the work laptop is for work: don't let children or housemates use it, and lock it when you step away (lesson 5.2);
updates also continue at home. A laptop that hasn't been to the office for weeks sometimes misses updates that are managed centrally. Check this;
access to business systems goes via a secure connection: a cloud service with https and two-factor authentication (2FA), or a VPN to the office. Never just open a port to be able to reach the NAS from home "for a moment".

On the road: public wifi

In a hotel, train or café, you don't know who manages the network. The biggest risk is a fake hotspot: an attacker sets up a network with the same name as the real one, for example "Hotel-Guests". Your phone connects automatically, and all your traffic goes through their device.

Fortunately, most traffic nowadays goes via https (lesson 4.2) and mail via encrypted connections. The attacker can then see which sites you visit, but not what you type in. Risks still remain, though: a login page that redirects you to a fake site, an "install this certificate" prompt, or old apps that don't encrypt.

The National Cyber Security Centre (NCSC) advises:

prefer mobile data or your own phone's hotspot over public wifi;
don't let your device connect automatically to wifi networks;
don't do banking or confidential work on public wifi, and don't download or install anything there;
turn off file sharing and log out when you're done.

If you get a certificate warning on public wifi for a site you know well, don't proceed. That's exactly the signal that someone is watching.

What a VPN does and doesn't do

The word VPN is used for two different things. A business VPN connects your laptop in an encrypted way to your office network, so you can reach the NAS or accounting software from outside. A commercial VPN service sends all your internet traffic encrypted to a provider's server, which then sends it on to the internet.

A VPN does	A VPN does not
Encrypt your traffic between your device and the VPN server, so the local (wifi) network can't see it	Protect you against phishing: a fake site is just as fake via a VPN
Give you secure access to the office network (business VPN)	Block malware or clean up an infected laptop
Hide your IP address from the sites you visit	Make you anonymous: logging in to a service still reveals who you are
	Remove the need for trust: the VPN provider can now see what the hotel network could see before

So a VPN shifts the point where you need to place your trust. On an unfamiliar network, that can be worthwhile. On your own home network with https sites, a commercial VPN adds little in terms of security.

And watch out: a VPN server at your office is itself an edge device that's reachable from the internet. Outdated VPN servers are a well-known entry point for ransomware (lesson 1.3). Keep it updated, turn on two-factor authentication (2FA), and switch it off when you're not using it.

In practice: what this looks like

Your mail also travels over the network while you're on the road. So set up your mail program with encrypted connections. At WebOké, for example, this means IMAP on port 993 with SSL/TLS and SMTP on port 587 with STARTTLS (or 465 with SSL/TLS); with other providers, the ports are usually the same. If your mail program shows "no security" or port 143 or 25 without encryption, change it.

Summary

Give your router its own admin password, turn off remote management, UPnP and WPS, and update the firmware.
Choose WPA3, or the WPA2/WPA3 transition mode, with a long wifi password. Never WEP, WPA or TKIP.
Put visitors and smart devices on a guest network, separate from your work devices.
On the road: prefer mobile data or your own hotspot, don't connect automatically, and stop at a certificate warning.
A VPN encrypts the section up to the VPN server, but doesn't protect against phishing or malware and doesn't make you anonymous.

Quiz

Exercise

Exercise D5.3: Checking your router and wifi. Log in to the settings page of your router (at home or at the office). Check the admin password, the encryption, WPS, UPnP, remote management, the firmware and the guest network. Tick off the checklist, test the guest network and answer the reflection questions.

Cookies at WebOké

Cookie settings

Necessary

Marketing