3.2 - Protecting Networks: Managerial Controls and Wireless Security
Managerial Controls for Network Security
The policies below are managerial controls: written rules that set the minimum configuration standard or minimum security requirements that every router, switch, VPN connection, and wireless network has to meet. The technical settings later on this page are how IT actually meets them.
Router Security Policies
Routers direct traffic between networks, so they need solid security configurations, and policies set the minimum standards for that.
Centralized authentication means banning local accounts on routers and requiring everyone to log in through an approved authentication server instead. Local accounts create real problems: passwords stored separately on each device, no way to instantly cut off access when someone leaves, inconsistent password enforcement, no audit trail of who accessed what, and having to manage passwords device by device. Centralized authentication through something like RADIUS or TACACS+ fixes all of that with one source of truth for credentials, instant revocation everywhere at once, centralized logging, consistent policy enforcement, and role-based access.
Example: when a network admin leaves the company, having local accounts on 50 routers means IT has to log into each one individually and delete the account, which takes hours and is easy to miss. With centralized authentication, disabling that one account instantly cuts off access to every device at once.
Disabling unnecessary services means turning off insecure or unneeded protocols. Telnet, for instance, sends everything including passwords in plain text, so it should be replaced with SSH, which encrypts everything. Similarly, plain HTTP management interfaces should be replaced with HTTPS using valid certificates, and any routing protocols not actually needed should be turned off to shrink the attack surface.
Example: with a policy requiring SSH and disabling Telnet, an attacker capturing network traffic gets nothing useful since all management sessions are encrypted. If Telnet were still on, they'd capture plaintext passwords and commands.
Firewall requirements mean routers either need firewall capability enabled and properly configured, or a dedicated firewall device deployed separately for more advanced protection.
A sample router policy might require: no local accounts, all admin logins going through a TACACS+ server, SSH version 2 or higher required with Telnet and HTTP management disabled (HTTPS permitted with certificate validation), unnecessary services like CDP, finger, and small services disabled, router access control lists enforcing ingress filtering (or a dedicated firewall), and logs sent to a central syslog server capturing every login attempt, config change, and access violation.
Switch Security Policies
Switches connect devices within a LAN, so they need their own security baseline.
Centralized authentication applies here too, same rationale as with routers: no local accounts, authenticate through an approved server.
Port security prevents unauthorized devices from just plugging in. It works by limiting how many MAC addresses a port will accept, and when a violation happens, the port can shut down completely, stay up but drop traffic from the unauthorized address and log the violation, or quietly drop that traffic without logging anything.
Example: a conference room jack limited to one MAC address disables itself and alerts security the moment an attacker plugs in a second device. Without port security, that attacker would've gotten instant network access.
MAC filtering whitelists approved addresses and blocks everything else, either statically (manually configured per port), dynamically (the switch learns and allows the first device it sees), or with "sticky" learning that saves what it learns permanently.
Example: a manufacturing floor only allows registered equipment like robots and control terminals. An employee trying to plug in a personal laptop to troubleshoot something gets blocked automatically since that device's MAC isn't recognized, keeping unauthorized devices off the industrial control systems.
A sample switch policy might require: port security on every access port with a max of 2 MAC addresses (main device plus phone) and a shutdown violation action, unused ports administratively shut down and placed in an isolated VLAN, no local accounts with RADIUS required and SSH only, a separate management VLAN, static MAC filtering on server ports with dynamic learning on user ports, and DHCP snooping enabled everywhere with only designated ports trusted for DHCP.
VPN Security Policies
VPNs create encrypted tunnels for remote access to internal networks, so policies need to spell out who can use them and how.
Authorized roles should be clearly defined, like full access for IT staff, executives, and approved remote workers, limited access for contractors restricted to specific resources, and no access at all for temp staff or interns unless specifically approved. Not everyone needs remote network access, and limiting who gets it shrinks the attack surface.
Example: a part-time receptionist asks for VPN access just to check schedules from home, but that's denied since receptionists don't actually need internal network access, they can use a web portal instead, avoiding unnecessary risk if their home computer ever gets compromised.
Authentication requirements should go beyond just a password, using things like public/private key cryptography (often via hardware tokens), multi-factor authentication combining a password with an authenticator app code, SMS code, hardware token, or biometric, and certificate-based authentication to validate identity. A strong requirement might be both a device certificate and MFA (password plus an authenticator app code). VPN credentials are extremely valuable targets, since stealing them gives remote access straight past perimeter security, so MFA is essential to prevent stolen credentials from becoming a full breach.
Split tunneling (also called dual tunneling) should generally be prohibited. Without split tunneling, all of a user's internet traffic routes through the VPN and gets filtered by corporate security controls. With split tunneling enabled, only corporate traffic goes through the VPN while everything else, like regular browsing, goes straight to the internet unfiltered. That's risky because the device ends up connected to both the corporate network and the open internet at the same time, so malware from a compromised website could spread straight into the corporate network with none of the usual filtering in place.
Example: an employee working from home with split tunneling enabled visits a compromised site and picks up malware. Because their device also has an active VPN connection, that malware can spread laterally into internal systems. Without split tunneling, the corporate firewall would've blocked the malicious site before infection even happened. Split tunneling does save bandwidth and improve browsing speed, but for sensitive environments, security usually wins out over that convenience.
A sample VPN policy might specify: access limited to full-time employees in IT, engineering, sales, and management, plus approved remote workers and limited contractor access; device certificates required plus AD password and MFA via an approved app; 8-hour session timeout requiring re-authentication; split tunneling disabled with all traffic routed through the VPN; personal devices required to use a virtual desktop; AES-256 encryption with perfect forward secrecy and TLS 1.2+; BYOD devices required to have full disk encryption, current antivirus, patches within 30 days, and an MDM agent; and all sessions logged with unusual patterns triggering review.
Wireless Security Policies
Enterprise authentication (using EAP tied to an authentication server) is stronger than a simple shared password. A shared pre-shared key has real downsides: one password for everyone, having to update every device when it changes, no way to know which specific user accessed the network, one compromised password affecting everybody, and former employees potentially still knowing it. Enterprise authentication (EAP) fixes this with individual credentials, instant revocation when someone leaves, centralized authentication through RADIUS, certificate options, and per-user logging.
Example: a company using a simple shared WPA2 password has a former employee who still remembers it. Months later, they sit in the parking lot, connect using that old password, and access confidential internal files. With enterprise authentication instead, their individual credentials would've been disabled the day they left, blocking this entirely.
Encryption requirements should mandate AES with at least 128-bit keys (256-bit preferred) using WPA2-Enterprise or WPA3, since weak encryption lets attackers decrypt captured traffic.
Beacon frame settings may also require disabling SSID broadcasting to reduce visibility, though this is a minor supplementary measure at best.
A sample wireless policy might require: WPA3-Enterprise with 802.1X authentication through RADIUS servers, EAP-TLS with certificates for high-security areas and EAP-PEAP acceptable for general use; AES-256 encryption with CCMP and perfect forward secrecy; segmented VLANs for guest (internet only), corporate (internal access), and IoT (isolated); SSID broadcast disabled for high-security networks; minimum power settings to prevent signal leakage; WEP, non-enterprise WPA, and WPS all prohibited; open networks banned except a clearly documented guest network; devices required to support WPA3 or WPA2-Enterprise at minimum; and a wireless intrusion detection system watching for rogue access points with all authentication attempts logged.
The Four Policies at a Glance
Policy | What it sets | What it may include |
Router security policy | Minimum configuration standard for routers | No local user accounts (all logins go through an approved authentication server); unnecessary services like Telnet disabled; a firewall required (built in, or a separate device) |
Switch security policy | Minimum configuration standard for switches | No local user accounts; port security enabled; MAC filtering |
VPN policy | Minimum security requirements for employees using a VPN to reach the internal network | Which roles may use the VPN; how they authenticate (public/private keys or MFA); no split (dual) tunneling |
Wireless security policy | Minimum security requirements for the organization's wireless networks | Users authenticate through EAP to an approved authentication server; all wireless traffic encrypted with AES at a minimum key length; beacon frames disabled |
Configuring Wireless Security Features
Disabling Beacon Frame Broadcasting
Access points normally broadcast beacon frames roughly every 100 milliseconds, announcing the network name, supported data rates, encryption, and channel info, which is how your phone finds nearby Wi-Fi networks. Disabling SSID broadcasting keeps the beacon frames going but strips out the network name, so it won't show up in device lists unless someone manually types it in.
Access points call this setting different things (hide SSID, disable SSID broadcast, or disable beacon frames), but the goal is the same: make it harder for adversaries to find the wireless network and learn its basic properties, starting with its name.
Example: a research facility hides its SSID, so an attacker scanning from outside can see that an encrypted network exists but can't tell what it's called, adding a bit of extra difficulty since they can't target it directly without first figuring out the name.
That said, this isn't foolproof. Determined attackers can still discover hidden SSIDs by capturing probe requests when legitimate devices connect, using wireless sniffing tools built to find hidden networks, or watching for connect and disconnect events that leak the name. It also hurts usability since users have to manually configure their connection. Best practice: treat this as one small layer in a bigger defense, not a real standalone security measure.
Controlling Signal Strength and Direction
Reducing an access point's transmission power limits how far its signal travels, which means surveying coverage needs for each area and configuring the minimum power that still gets the job done, avoiding excess power that bleeds into parking lots or neighboring buildings.
Example: a law firm on the 3rd floor of a building finds their default access point settings are broadcasting into the parking garage and the floors above and below. Cutting power to 50% keeps solid coverage on their own floor while significantly reducing how far the signal reaches beyond it.
Directional antennas focus signal toward a specific area instead of broadcasting in every direction, which is useful for point-to-point links between buildings, long corridors, or open spaces where you want coverage without leaking into a parking lot.
Example: a warehouse needing coverage along a 300-foot aisle uses directional antennas at each end, getting strong coverage where it's needed while cutting way down on signal outside the building.
Physical placement matters too, mounting access points on interior rather than exterior walls, keeping them away from windows, and letting building materials like concrete or metal act as natural signal barriers. After configuring all this, it's worth doing a wireless survey to confirm signal isn't leaking beyond the secured area.
Implementing Strong Wireless Encryption
Some protocols should never be used. WEP has fundamental flaws and can be cracked in minutes with free tools, full stop. WPS, designed for easy pairing via an 8-digit PIN, is vulnerable to brute force and can be cracked in hours, so it should be disabled even if you're otherwise using WPA2 or WPA3. The original WPA improved on WEP but still has known vulnerabilities and has been superseded.
Example: a company still on WEP "because we've always used it" gets a security assessment where the consultant captures traffic from the parking lot for 5 minutes and cracks the key in 3 more, demonstrating full access including reading other users' traffic. The company switches to WPA3 immediately afterward.
WPA2 is solid when configured properly, using AES encryption in either WPA2-Personal (a shared password, fine for home use but not ideal for organizations) or WPA2-Enterprise (individual authentication via RADIUS, the standard for corporate environments). WPA3 is the current strongest standard, offering better protection against offline dictionary attacks and forward secrecy (meaning a compromised session doesn't expose past ones), also with Personal and Enterprise modes, the latter offering an optional 192-bit security mode for the highest security needs.
A strong configuration would use WPA3-Enterprise, 802.1X with EAP-TLS, AES-256-CCMP encryption, proper key management, redundant RADIUS servers, and hourly re-authentication, which together means individual authentication, the strongest available encryption, certificate-based identity, and a short window if credentials ever get compromised.
User Authentication and MAC Filtering
802.1X is a port-based access control standard requiring authentication before granting network access. A device tries to connect, the access point blocks all traffic except the authentication exchange, it forwards those credentials to a RADIUS server, the RADIUS server checks them against a directory like Active Directory, and if valid, the access point opens up and grants access; if not, it stays blocked.
Example: an employee's laptop presents its certificate through 802.1X, the access point forwards it to RADIUS, which validates it against the corporate PKI, and access is granted. A visitor's device with no valid credentials simply can't authenticate and gets denied.
MAC filtering maintains a list of allowed (or denied) addresses. A whitelist approach only lets listed addresses through, blocking everything else; a blacklist approach blocks specific addresses while allowing everything else, which is less secure.
Example: a medical office allows only its specific patient-record tablets to connect via MAC filtering. An employee's personal phone gets blocked outright, even with the correct password, since its address just isn't on the list.
MAC filtering has real limits, since attackers can spoof a MAC address to impersonate an authorized device, and managing address lists at scale gets tedious. It works best as a supplementary layer, not your main line of defense.
The strongest approach combines multiple layers: WPA3-Enterprise encryption, 802.1X authentication via RADIUS, certificate-based device authentication, MAC filtering as an extra check, and network access control verifying a device's security posture before it connects.
Example: a financial firm combines all of these, so an attacker who steals a password still can't get in, since they'd also need the device certificate, a registered MAC address, and a device that passes the security posture check. No single stolen credential defeats the whole system.