The shared passphrase problem
A single pre-shared key means every device, from the CEO laptop to a contractor phone, holds the same credential. It leaves with every departing employee, it cannot be revoked individually, and it grants identical access to everyone who has it.
For any organisation above about twenty users, this is the weakest link in an otherwise reasonable security posture.
Identity-based access with 802.1X
802.1X authenticates the user or device against your directory, then applies access based on who they are. A staff member and a student can associate to the same access point and land in completely different network zones.
- Staff: corporate zone with access to file and application servers
- Students or contractors: internet plus a narrow set of published services
- IoT and biomedical devices: certificate or MAC-based, isolated by policy
- Guests: captive portal, internet only, bandwidth shaped
Credential revocation becomes an account change rather than a network-wide passphrase rotation.
RF design decides whether any of it works
Security controls fail in practice when the wireless simply does not perform. Users tether to mobile data and bypass everything you built.
Do the survey. Predictive modelling first, then on-site validation with the real building materials in place. Density matters more than raw coverage: a lecture hall with 200 concurrent devices needs a different access point count than a warehouse with ten.
Enable band steering, tune minimum data rates to keep slow clients from dragging down a cell, and disable legacy rates you no longer support.
Monitor it like the rest of the network
Wireless controllers produce association, authentication and rogue AP data. Feed it to the same monitoring stack as your firewalls and endpoints. Rogue access points and repeated 802.1X failures are early signals worth alerting on.