5 Key Steps to Improve Office Network Security

2025-03-10 | Network Security

WPA3, VLANs, 802.1X, patches and backups: five steps to a safer office network.

First, Be Clear: Office Network Security Is Not a Single Product

Many SMEs assume network security means "buy a firewall" or "set a complicated Wi-Fi password". In reality, office network security is a set of measures that work together: encryption, segmentation, authentication, patching, monitoring, backup, and training. A gap in any one of them leaves an opening. A single breach can expose client data, halt business operations, and affect a company's ability to meet its security obligations under Hong Kong's Personal Data (Privacy) Ordinance. This article covers the five steps most worth doing, then corrects three long-circulating misconceptions that are not real security measures, giving Hong Kong SME readers a direction they can act on immediately.

Step 1: Upgrade Wi-Fi Encryption to WPA3 (and Handle Legacy Devices Properly)

What Is Wrong with WPA2

WPA2 was once the mainstream standard, but its 4-way handshake design has a fundamental weakness. In October 2017, Belgian researcher Mathy Vanhoef disclosed KRACK (Key Reinstallation Attack): an attacker manipulates and replays 4-way handshake messages, tricking a victim device into reinstalling an already-in-use key, which resets and reuses the nonce (packet number / initialisation vector), weakening encryption so the attacker may decrypt traffic; in some network configurations, data may also be injected or tampered with. The key point is that the flaw is in the Wi-Fi standard itself, not in an individual product's implementation, so any device correctly implementing WPA2 could be affected, and the attacker must be within Wi-Fi signal range to launch the attack. Note also that simply changing the Wi-Fi password does not prevent or mitigate KRACK; the fix is to update device firmware and systems.

What WPA3 Improves

WPA3 is the standard announced by the Wi-Fi Alliance in 2018 to succeed WPA2; certification began in June 2018, and since July 2020, devices carrying the "Wi-Fi CERTIFIED" mark must support WPA3. WPA3-Personal replaces the WPA2-Personal PSK 4-way handshake with SAE (Simultaneous Authentication of Equals, also known as the Dragonfly handshake), bringing several important improvements. First, stronger resistance to offline dictionary attacks: unlike WPA2, an attacker cannot capture one handshake and then guess passwords offline without limit; each authentication attempt requires real-time interaction with the AP, and the network itself becomes the rate-limiting factor. Second, forward secrecy: even if the password is later cracked, previously captured and recorded traffic will not be decrypted as a result, because each SAE authentication generates a new Pairwise Master Key (PMK). Third, WPA3 mandates Protected Management Frames (PMF, IEEE 802.11w), making forged management frames (for example, deauthentication attacks that use fake frames to kick clients off) harder to succeed; in the WPA2 era, PMF was only optional. On encryption, WPA3-Personal requires a minimum of CCMP-128, WPA3-Enterprise mode offers an option with equivalent 192-bit encryption strength, and WPA3 does not allow TKIP. WPA3 also supports Opportunistic Wireless Encryption (OWE) for open networks, which the Wi-Fi Alliance calls "Wi-Fi CERTIFIED Enhanced Open": it encrypts password-free open networks but provides no identity authentication, so it cannot guard against rogue APs. To be clear: WPA3 significantly improves WPA2's handshake weaknesses, but it is not "upgrade once and forget about it" — it still needs to be combined with firmware updates, segmentation, authentication, monitoring, and other measures.

How to Use Transition Mode

WPA2/WPA3 transition mode allows an AP to support WPA2 and WPA3 at the same time: WPA3-capable devices connect with WPA3, while legacy devices keep connecting with WPA2 to the same AP. But its limits must be stated clearly: under transition mode, clients negotiating WPA2 still carry WPA2-era handshake risks, and there is also the possibility of being downgraded back to WPA2. Transition mode should be treated as a migration tool, not the destination; legacy devices should be phased out on a plan, not left in mixed mode indefinitely. In practice, start by inventorying devices to confirm which support WPA3, which only support WPA2, and which support neither. Legacy devices that do not support 802.1X / WPA3 (for example, old printers and IoT equipment) should not keep the whole network on PSK; isolate them on a dedicated restricted VLAN and plan their replacement. One more reminder: early SAE implementations were found by researchers to have side-channel issues, which vendors later addressed through firmware patches. The lesson is that a stronger standard does not mean every implementation is flawless; keeping firmware updated remains necessary.

Do These at the Same Time: Disable WPS, Change Default Passwords, Turn Off Remote Management

Alongside the encryption upgrade, three basics should be done together: disable WPS (Wi-Fi Protected Setup) — the WPS PIN can be brute-forced, leaking the PSK; device pairing can switch to a more secure pairing method, such as WPA3's DPP (Device Provisioning Protocol, for example pairing with a QR code). Change the default administrator passwords on all network equipment. Unless genuinely needed, turn off remote management, so management interfaces are not directly exposed to the internet.

Step 2: Segment the Network with VLANs (Staff / Guest / IoT / Servers / Management)

Why Segment

A VLAN (Virtual Local Area Network) divides one set of physical hardware into multiple logically isolated networks. Devices on different VLANs cannot communicate with each other by default unless explicitly permitted through a firewall / router. The value of segmentation is containment: one compromised device does not mean the whole network falls; guest devices, IoT devices, and core servers should not be able to see each other in the same broadcast domain.

How to Divide: Five VLAN Categories

Office segmentation can start with the following five categories. Do not over-segment — a typical office does not need one VLAN per person, as excessive subdivision makes management unworkable. Group by security profile and function, not purely by department name:

• Staff VLAN: staff desktop computers, laptops, VoIP phones.
• Server VLAN: file servers, application servers, domain controllers, and similar.
• Management VLAN: management interfaces of switches, routers, firewalls, APs, and other network equipment, accessible only to administrator devices.
• Guest VLAN: guest Wi-Fi, internet access only, no access to internal VLANs.
• IoT / printer VLAN: printers, IP cameras, access control, smart devices, and other non-user devices.

Each VLAN should have its own IP subnet and default gateway, typically configured on a Layer 3 switch (SVI) or router; DHCP assigns addresses per VLAN. For Wi-Fi, create separate SSIDs for staff and guests, each mapped to its own VLAN; the guest network should enable client isolation so guest devices cannot see or communicate with each other. For IoT, remember: IoT devices are usually the weakest link and should sit on their own VLAN; IoT needing internet access (for example, cloud services and firmware updates) does not mean it should be allowed to reach the trusted network — the purpose of segmentation is lateral containment, not total disconnection. Also, never port-forward an NVR directly to the internet; remote viewing should go through a VPN or the vendor's official application.

Firewall Rule Principle: Default Deny

A VLAN by itself is not encryption, nor is it a firewall — VLANs are an isolation method that only delivers real isolation when combined with firewall rules. The ACL / firewall rule principle is default deny: only allow the traffic that is genuinely necessary. For example: office computers to servers, only allow the ports the application actually needs; guest Wi-Fi, internet access only, no access to internal VLANs; the CCTV VLAN generally does not need direct internet access, only the connections the NVR and viewing application actually need; the management VLAN, only accessible from administrator workstations. For ports, end devices use access ports (untagged), one VLAN per port; trunk ports (tagged) are only used between switches, and between firewalls and APs; do not carry user data on the native VLAN; disable unused ports.

Common Mistakes

• Setting up VLANs but allowing "any to any" between them — equivalent to no segmentation.
• Leaving switch / AP management interfaces on the user VLAN.
• Mixing guest Wi-Fi with the office network "temporarily".
• No documentation, so nobody knows which port belongs to which VLAN.

So after segmentation, documentation is essential: label cables and ports, keep the IP and VLAN plan, and keep a simple network diagram.

Step 3: Move from a Shared Wi-Fi Password to 802.1X / RADIUS Enterprise Authentication

The Problem with Shared Passwords

WPA2/WPA3-Personal (PSK) means the whole company shares one Wi-Fi password — everyone uses the same key. The problems are practical: when someone leaves, the whole company must change the password to revoke one person; all users look identical on the network, with no per-user audit trail; everyone shares a key derived from the same password, so anyone who knows the password may theoretically be able to decrypt other users' over-the-air captured packets (a risk for unencrypted traffic).

How 802.1X Works

WPA2/WPA3-Enterprise (802.1X) gives each user or each device independent credentials, verified by a RADIUS server. The benefits include: independent identity and auditability — every connection has an independent identity, so it is possible to record who connected and when; individual revocation on departure or device loss — just disable the individual user account or revoke the individual certificate, without affecting others; independent encryption keys per session; dynamic VLAN assignment — the RADIUS server can automatically place a user / device into its VLAN after successful authentication, without manual division by SSID; and additional access policies — the RADIUS server can apply extra policies, such as connection times, permitted devices, and permitted APs. 802.1X can also be used on wired networks: if the switch supports it, users plugging in a LAN cable must also authenticate before accessing the network and the internet. On infrastructure, be honest about the complexity: PSK only needs APs; 802.1X needs APs plus a RADIUS server (self-hosted or a cloud RADIUS service), plus certificate management or directory services (for example, Active Directory / LDAP).

Credentials vs Certificates: PEAP vs EAP-TLS

EAP-PEAP (username and password) uses a username plus password, and devices do not need pre-configured certificates, so deployment is easier; the downside is that it still involves passwords, with phishing and sharing risks. EAP-TLS (certificates) uses X.509 certificates for mutual authentication — both the client and the RADIUS server must have certificates; no password or password hash travels over the network, so it mitigates Evil Twin (rogue AP), password spraying, and offline dictionary attacks. Security is clearly higher, but certificate management is required (issuing, distribution, renewal, revocation). A practical migration suggestion: many organisations start with PEAP for a fast migration, then gradually move managed devices to EAP-TLS certificates. Be precise: do not write "802.1X means you never have to think about passwords again" — PEAP still uses passwords; only EAP-TLS moves away from passwords.

Joiner / Leaver Process

• Joiner: create an independent account / issue a certificate → assign VLAN / access policy by role → configure the device (managed devices can have settings pre-provisioned) → record which account maps to which device.
• Leaver / lost device: immediately disable the account / revoke the certificate → confirm that identity can no longer connect → recover / wipe the certificate and Wi-Fi settings on the device → check logs for any abnormal connections.

The key point: do this on the day of departure, not "when there is time".

Handling Devices That Do Not Support 802.1X

Old printers, IoT sensors, and some meeting-room equipment may have no 802.1X supplicant and cannot perform EAP authentication. Do not let a minority of devices keep the whole network on PSK. Instead, place these devices on a dedicated restricted IoT VLAN, using MAC Authentication Bypass (MAB) or Dynamic Private PSK (PPSK / MPSK) as a fallback, with strict firewall rules limiting their access, and plan their replacement. Note that MAB is only a fallback, still based on a forgeable MAC — do not present MAB / MAC authentication as equivalent to 802.1X security. For migration, do not switch over in one go. Run both in parallel: keep the existing PSK SSID while adding a new 802.1X SSID; migrate users in batches; disable the PSK SSID when done.

Step 4: Firmware Updates, Firewall, and Monitoring (What an SME Can Realistically Do)

Firmware Update Process

Regular patching exists to close known vulnerabilities. When a vendor releases an update, it is usually because a new threat or vulnerability has been found; unpatched systems are easier to compromise and affect the security of the whole network. A suggested process:

• Inventory: maintain a list of all network devices, including model, firmware version, and operating system, so devices needing updates can be identified quickly.
• Official sources only: download firmware updates and read security advisories only from the vendor's official website — never use firmware from unknown third-party sources, to avoid installing malware disguised as an update.
• Back up settings before updating: back up device settings before a firmware update, in case the update process goes wrong.
• Read the release notes: before updating, read the vendor's release notes to understand the fixes, known issues, and compatibility impact.
• Test and roll back: test within a tolerable scope first, and keep a rollback plan; in environments with a central management platform, use the platform for scheduling, monitoring, and rollback.
• Prioritisation: prioritise internet-facing / edge equipment (firewalls, VPN gateways, edge routers), then internal infrastructure with broad network access (core switches, NAS, management servers), then IoT / operational devices (IP cameras, printers, building management systems).

Also pay attention to the vendor's End-of-Life (EOL) policy. After a device reaches EOL, it may no longer receive security updates, becoming vulnerable, and replacement should be planned. When purchasing, factor in the vendor's firmware security record, vulnerability disclosure process, and update delivery method. For vulnerability information, refer to the National Vulnerability Database (NVD) under the US National Institute of Standards and Technology (NIST) and vendor advisories to assess whether devices have known vulnerabilities. A router self-check list: enable automatic firmware updates (if the device supports it); change the default administrator password; turn off remote management unless genuinely needed; use WPA3 or WPA2 encryption, never open or WEP; put guest and smart devices on separate networks; if a router no longer receives vendor updates, consider replacing it. Be clear about the limits: updates close known vulnerabilities, but cannot guarantee there are no unknown vulnerabilities; they still need to be combined with segmentation, monitoring, and other measures.

Firewall Configuration Essentials

A firewall's basic role is to monitor and control traffic entering and leaving the network; combined with VLAN segmentation, it enforces allow / block rules between VLANs. Intrusion detection / prevention (IDS / IPS) detects and responds to unauthorised access or suspicious activity; keeping signatures / rules updated is what allows detection of malicious traffic targeting known vulnerabilities. Practical SME steps: close unneeded services and ports, keeping only the ports and protocols the business genuinely needs; lock down management interfaces — firewall / router / AP management interfaces should only be reachable from trusted management networks / administrator devices, and administrator logins should use MFA; enable logging — firewall allow / deny events, privileged access, administrator actions, and authentication events for remote and sensitive systems; without logs, there is no way to investigate an incident; and run regular vulnerability scans to find other security weaknesses. Guest traffic can optionally go through a DNS filtering service, blocking known unsafe or inappropriate content and providing basic phishing protection.

Monitoring Does Not Need a 24/7 SOC, but It Needs a Mechanism

Many SME teams have no round-the-clock internal SOC. That is a common situation; what matters is that the responsible person and the escalation path are clear. A lean monitoring model: triage by severity; every high-severity event has a named owner; a documented escalation path (who notifies whom, who decides to disconnect the network / seek external help); and regular review of alert settings to reduce alert fatigue. Regularly review firewall logs for abnormal logins, abnormal traffic patterns, abnormal logins outside office hours, and abnormal outbound uploads. Write a one-page response plan in advance — do not wait for an incident to start thinking. Do not exaggerate: do not write that an SME needs to build its own 24/7 SOC to be secure; nor that "installing a firewall means you are secure" — a firewall only works with correct configuration, updates, logging, and monitoring, and a misconfiguration (for example, allowing everything) is equivalent to having no firewall. Many SME-level IDS setups only detect and alert, and still need a person to follow up; they cannot handle everything automatically.

Step 5: Backup, Incident Response, and Staff Training (Too Late to Think About It After the Fact)

The 3-2-1 Backup Principle

The 3-2-1 principle is a framework mentioned in NIST / NCCoE guidance: keep three copies of important files (one primary file plus two backups); store files on two different media types, to handle different kinds of hazards; and keep one copy offsite (for example, away from the office / home). But numbers alone are not enough — the key supplements must be done too: at least one backup must be offline / isolated / not modifiable or deletable with everyday credentials. Ransomware actively searches for and deletes or encrypts accessible backups; if all backups stay mounted on the same compromised computer, the backups themselves will be encrypted. An external hard drive should be disconnected after the backup completes; a cloud backup should have an independent retention policy and independent access credentials, ideally with immutability / deletion protection. Cloud sync is not backup: sync services mirror changes in real time, and ransomware encryption will be synced to the other copy as well; a genuine cloud backup should use scheduled snapshots, an independent retention policy, and independent access credentials. Backups must be restore-tested: regularly restore sample files, and record the steps, the credentials needed, and the actual restore time; an untested backup cannot be assumed to restore. RTO (Recovery Time Objective) and RPO (Recovery Point Objective) are concepts only, without numbers: RTO is how quickly files and applications should be restored to keep the negative impact on the business at an acceptable level; RPO is how much data loss is acceptable (that is, the maximum acceptable age of a backup file). Different file types / business processes can have different RTOs and RPOs; readers should set their own, rather than being handed a single universal number.

Basic Ransomware Response

The following are generally accepted response steps, kept feasible for SMEs. First, identify affected systems and isolate them immediately; if multiple devices are affected, consider taking the network offline to stop the spread. Second, do not wipe immediately — preserve evidence; do not erase systems or delete logs before investigation; highly volatile evidence (for example, memory) should be preserved carefully. Third, notify the relevant people: notify IT support / the responsible person; if there is cyber insurance, notify the insurer; seek external incident response support as needed. Fourth, triage affected systems and arrange recovery and restoration, compiling an initial understanding and recording what happened. Fifth, restore from a clean backup only after affected systems have been cleaned or rebuilt; do not restore before cleaning, or re-infection may follow; the backup used for restoration should predate the start of the intrusion, not just the encryption event. Sixth, strongly do not pay the ransom: paying may encourage attackers to target more organisations and fund illegal activity, and does not guarantee files can be recovered. Preparation before the fact matters more than response after it: write a one-page incident response plan (who is responsible, how to isolate an affected computer, where the backups are, who communicates externally), and run regular tabletop exercises so everyone knows their role. Do not write "having a backup guarantees full recovery" or "paying the ransom will get files back".

Staff Training: Spotting Phishing

Phishing emails / messages / calls impersonate trusted sources to trick recipients into clicking a link, providing a password, or making a transfer. Many intrusions start with a single click, so staff training is not an add-on — it is part of security. Training content can use this list: sudden urgency (for example, "payment must be made today", "account closes in one hour"); requests to change bank details, buy gift cards, or handle unusual payments; do not verify using a phone number / link supplied in the message — verify through a known, trusted channel (for example, a number in the company directory, or in person); and when a suspicious message arrives, report it through a single, clear channel (for example, a designated email alias or a designated chat channel). Training rhythm is a suggestion, not a legal requirement: short and frequent beats one long session a year — for example, one short topic a month, one drill or scenario discussion a quarter, and new joiners learning basic security (passwords, MFA, how to report suspicious messages) before getting full access; teaching with real examples (sharing a recent phishing email with the team after removing private data) works better than slides alone; publicly available free security-awareness materials can also be used as reference. Reporting culture must be stressed: the goal is not "zero clicks" but "fast reporting" — a person who reports within minutes of clicking is far better than a perfect test score with a hidden mistake; do not shame staff who clicked a phishing link — shaming only makes people hide mistakes and slows response; thank people who report, even if it turns out to be a false alarm. Staff are not "the weakest link" — staff are an important line of defence, and training plus an easy reporting mechanism is what makes that defence work.

Hong Kong SME Responsibilities Under the PDPO (DPP4)

Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) is built around six Data Protection Principles (DPPs), and the regulator is the Office of the Privacy Commissioner for Personal Data (PCPD). DPP4 (Data Protection Principle 4: security of personal data) requires data users to take "all practicable steps" to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use; where a data processor is engaged, the contract between the data user and the processor should properly set out the processor's obligations. The PCPD's supplementary guidance notes that the level of security required rises with the sensitivity of the personal data — for general employment-related personal data, password and user identity protection may be sufficient; but for sensitive data (for example, sensitive medical data), placing it on a connected system without additional security measures may not be enough. Office network security is not purely a technical matter — it is also part of fulfilling DPP4's "all practicable steps": access control, role permissions, encryption in transit and at rest, audit logs, security risk assessments, and retention and destruction policies are all common examples of security measures. On data breach handling, the PCPD strongly recommends handling a data breach promptly and notifying the PCPD and affected individuals, especially where the breach may cause real harm; this should be read as a recommendation, not as "a statutory duty to notify within a specific deadline". Finally, be clear: DPP4 is about "all practicable steps" — a whole security arrangement, not a single product. Do not present DPP4 as "compliant as long as there is a firewall".

Common Misconceptions: These Three Are Not Real Security Measures

Misconception 1: Hiding the SSID Is More Secure

Fact: hiding the SSID is not a security measure — it only means "not broadcasting the name". When an SSID is hidden, the AP simply leaves the SSID field blank (null) in beacon frames; the beacons themselves still exist, and other characteristics of the network remain observable. To connect to a hidden network, a client must actively send a probe request containing the SSID in plaintext; the AP's probe response also contains the SSID. During authentication / association, the SSID also appears in management frames. These management frames are not protected by WPA2 / WPA3 encryption. In other words, once a single legitimate device has connected, the hidden SSID is exposed over the air; anyone monitoring the channel with a packet-sniffing tool can see it, without bypassing authentication or using advanced attacks. Worse, hiding the SSID may cause devices to keep broadcasting probe requests in different places looking for this network, leaking the SSID instead and even making the network a target. Practical downsides also include: added configuration complexity (every new device must be entered manually), compatibility issues with some legacy devices / IoT devices, harder troubleshooting, and a false sense of security that leads people to neglect genuinely effective measures (such as WPA3 and 802.1X). The correct framing: hiding the SSID should not be listed as a security measure; if you have already hidden yours, there is no need to panic — just do not rely on it to stop intruders. What genuinely works is WPA3, strong authentication, segmentation, and similar measures.

Misconception 2: MAC Filtering Can Stop Intruders

Fact: MAC address filtering can be easily bypassed with MAC spoofing, and is not a real security measure. MAC addresses are transmitted in plaintext in every frame; an attacker only needs to sniff traffic, read the MAC of an authorised device, then set their own device's MAC to the same address — the network cannot tell the difference, because a MAC is only a self-declared label with no authentication. Modern operating systems (for example, iOS / Android) use randomised MAC addresses by default for privacy (per-network randomised addresses), further making static MAC filtering unworkable. MAC filtering provides no encryption and does not verify user identity; it only controls which devices can connect, not what they can do after connecting. MAC filtering is at most an extremely thin threshold — do not rely on it; real authentication should rely on WPA3 / 802.1X / certificates.

Misconception 3: A Complex Password Means You Are Secure

Fact: a complex password does not equal security; passwords have fundamental limits and must be combined with additional factors such as MFA / 802.1X. Phishing attacks do not care how long or complex a password is; data breaches can also expose credentials regardless of password strength. A password that satisfies "one uppercase + one number + one symbol" rules (for example, common predictable combinations) can still be among the first passwords guessed. Length matters more than complexity rules; relevant guidance stresses: prioritise length, do not force character combinations, do not force periodic password changes (change only when there is a breach or suspicious activity), check new passwords against known breached / commonly used password lists, and use a unique password per account (a password manager is recommended). MFA matters because even if a password is stolen, the attacker still needs a second factor to log in; prefer authenticator apps or hardware security keys over SMS verification codes (SMS codes carry interception risk). For Wi-Fi itself, a complex shared password is not security either: under PSK, everyone shares the same password, and once it leaks, the whole company must change it; 802.1X / certificates are what deliver per-person identity and revocation. In short: passwords should be long, unique, and managed with a password manager; but a password is only the first door — MFA must be added; and for Wi-Fi, move from a shared password to 802.1X.

Other Misconceptions (Brief)

• "Installing a firewall means you are secure": a firewall needs correct configuration, updates, logging, and monitoring; a misconfiguration is equivalent to no firewall.
• "Cloud sync is backup": sync mirrors encryption; it is not backup. Backup needs an independent retention policy and restore testing.
• "Guest Wi-Fi with a password is secure": having a password does not mean isolation; the guest network must be isolated from the internal network via VLAN plus firewall rules, or guest devices can still reach internal resources.
• "Firmware updates are a hassle — deal with it when something happens": unpatched known vulnerabilities are among the most common intrusion routes; backing up settings, reading release notes, and keeping a rollback plan before updating already keeps the risk at an acceptable level.

Priority Table

The ordering below follows the principle "close the biggest risks first, then make structural improvements, then keep up ongoing work". It is a suggested ordering, not a standard. Do not read it as "doing the first three items means you are secure".

Summary: Where to Start

An immediate checklist. First, check whether the AP already runs WPA3, and whether legacy devices have a transition plan; disable WPS and change all default administrator passwords. Second, confirm the guest Wi-Fi is already isolated from the internal network via VLAN and firewall rules, and that client isolation is enabled on the guest network. Third, consider whether the company still uses one Wi-Fi password shared across the whole company — if so, start planning an 802.1X parallel SSID. Fourth, check whether firmware is up to date, and whether management interfaces are restricted to the management network with MFA enabled. Fifth, confirm backups follow 3-2-1, with at least one offline / isolated backup, and when a restore test was last done. Sixth, write a one-page incident response plan and run a tabletop exercise with the team. The measures above can significantly reduce the risk of common intrusions, but network security is ongoing work that needs regular review and updates — do not read this as "doing them means absolute security". If you want to start from network planning, take a look at our office network solutions and Wi-Fi solutions pages to see how these measures are put into practice.

FAQ

Is hiding the SSID useful?

No. Hiding the SSID only stops the name being broadcast; the SSID still appears in plaintext in probe requests, probe responses, and association management frames, and these management frames are not protected by WPA2 / WPA3 encryption. Do not list it as a security measure, and do not rely on it to stop intruders.

What if legacy devices do not support WPA3?

Start by inventorying devices to confirm which support WPA3 and which only support WPA2. Transition mode (WPA2/WPA3) can be used during the transition, but remember it does not equal full WPA3 — plan to phase out legacy devices. Legacy devices that do not support 802.1X / WPA3 should be isolated on a dedicated restricted VLAN, not used as a reason to keep the whole network on PSK.

Does a small company need 802.1X?

Not immediately, but as headcount grows and staff turnover appears, the management cost and risk of shared passwords rise. A small company can start by adding an 802.1X SSID in parallel, migrating in batches, and disabling the PSK SSID when done.

What is the difference between backup and sync?

A sync service mirrors changes in real time — ransomware encryption will be synced to the other copy as well. A genuine backup uses scheduled snapshots, an independent retention policy, and independent access credentials, plus regular restore testing to confirm it actually restores.

免費上門勘查及報價 | 收費指南