Guest Wi-Fi: Why to Keep It Separate from Your Business Network

A client waiting at the front desk asks for the Wi-Fi password. In many small businesses, they get the staff one. Their phone then lands on the same network as the workstations, the printer and the file server. The Canadian Centre for Cyber Security has a whole publication on this exact subject. Its answer is simple: guests get their own network, an access point to the internet that is separate from your primary network (ITSAP.80.023).

Why it matters

The Canadian Centre notes that guest Wi-Fi networks are common targets for threat actors. For an organization, a separate guest network reduces the risk of attackers reaching the devices and information on the primary network (ITSAP.80.023).

Its other publications reason the same way. Its guidance on Wi-Fi in organizations says guest traffic must be separated from normal corporate traffic (ITSAP.80.009). Its baseline controls for small and medium organizations go further: an organization should never connect a public Wi-Fi network to its internal networks and resources, such as printers or audiovisual systems (baseline controls, BC.9.5).

A visitor does not need to see your server. Their device, which you do not manage, has no business on the same network as your data.

1. Create a separate guest network

Most routers and business access points offer a guest network. Get Cyber Safe recommends giving it a unique name and password, different from the staff network’s (Get Cyber Safe).

The Canadian Centre spells out the technical means: virtual LANs (VLANs) that restrict guests and their devices from interacting with the primary network (ITSAP.80.023). Its technical publication on Wi-Fi security says to segment your network into security zones, with one VLAN for each network name (SSID) (ITSP.80.002). Between the two zones, the firewall decides what gets through: the baseline controls speak of isolating the Wi-Fi network with a firewall (baseline controls).

2. Isolate guests from one another

Separating guests from your workstations is not always enough. The same technical publication recommends turning on client isolation, to prevent devices on the guest network from talking directly to each other (ITSP.80.002). One visitor’s phone has no reason to see another visitor’s laptop.

3. Encrypt with WPA3, or at least WPA2

The Canadian Centre recommends the WPA2 or WPA3 security protocols for the guest network (ITSAP.80.023), and describes WPA3 as currently the strongest encryption (ITSAP.80.009). For all new deployments, its technical publication calls for WPA3 (ITSP.80.002).

4. Change the default passwords

Many wireless devices ship with insecure defaults (ITSP.80.002). The Canadian Centre says to change the default passwords for the network and for the router’s administrator account (ITSAP.80.009). Get Cyber Safe points out that if they were never changed, they are probably printed on the back of the router (Get Cyber Safe), in plain view of anyone who walks by.

5. Keep the equipment up to date

The Canadian Centre says to keep the router and its firmware updated (ITSAP.80.023). Its technical publication gives a real example: in 2015, a flaw in ANTLabs routers led to breaches at 277 hotels, convention centres and data centres (ITSP.80.002). A device forgotten in a closet is still a way in.

What about a separate internet connection?

To go further, the Canadian Centre’s guidance on Wi-Fi in organizations suggests considering a separate internet subscription for guest access (ITSAP.80.009). Guests then do not even share your link to the internet.

Two common situations in small businesses

The guest network exists, but it runs over the same network as the workstations because nobody configured the VLAN. Or it does not exist, and the staff password is posted on the meeting room wall. That is what our article on Wi-Fi for a growing office calls a flat network. Segmentation is settled when the network is designed; it is at the heart of our Business networking and Aruba Wi-Fi pages.

Frequently asked questions

Do guests need a separate Wi-Fi network?

Yes: the Canadian Centre for Cyber Security recommends a guest network separate from the primary network, to reduce the risk of attackers reaching the business’s devices and information.

WPA2 or WPA3 for guest Wi-Fi?

The Canadian Centre recommends WPA2 or WPA3, describes WPA3 as currently the strongest encryption, and calls for it in all new deployments.

What is client isolation?

A wireless setting that prevents devices on the guest network from talking directly to each other; the Canadian Centre recommends turning it on.

What now?

Not sure whether your guests are really kept apart from your workstations and your server? Ask for MPJM’s free network analysis, offered to businesses with 10 or more workstations.

P.S. Sixteen questions, eight domains, a clear picture of your strengths and blind spots: start the assessment.