According to the Wi-Fi Alliance, there are now more IoT devices than there are humans on Earth, and over 50% of internet traffic travels through wireless networks. As people’s dependence on connected devices has grown, free public WiFi has become insanely popular, but it’s also insanely insecure. Even password-protected home and business wireless networks are open to attack, as evidenced by the recent discovery of yet another serious vulnerability in the WPA2 WiFi security protocol. Earlier this year, the Wi-Fi Alliance announced the launch of the WPA3 WiFi security standard, which seeks to ameliorate some of the security problems with WPA2. Here’s what your business needs to know about it.
What Are WPA2 & WPA3?
Wi-Fi Protected Access (WPA) is a security standard developed by the Wi-Fi Alliance, a non-profit organization that promotes wireless technology and certifies products that conform to their standards. WPA3 was developed to replace WPA2, which was launched in 2004.
What’s New In WPA3?
The WPA3 standard offers several significant security improvements for both personal and enterprise networks. Because enterprise cyber security must consider personal devices brought in by employees, customers, and vendors, both the personal and enterprise versions are of relevance to organizations.
Protection Against Brute-Force Password Hacks
First, WPA3 has more robust password-based authentication that protects against brute-force offline dictionary attacks, even when users’ passwords “fall short of typical complexity recommendations.” This is accomplished through Simultaneous Authentication of Equals (SAE), which replaces the Pre-shared Key (PSK) used in WPA2-Personal. Hackers will be prevented from making more than one offline guess at a password; they’ll be forced to interact with the live connected device each time, which is much more difficult.
Protection on Public WiFi Networks
WPA3 also makes connecting to public WiFi safer with “individualized data encryption.” Users’ individual data streams will be encrypted when they connect to public WiFi, even on networks that do not require a password.
Forward Secrecy
The new “forward secrecy” feature protects older data from being compromised by a later attack. This means that even if a hacker manages to break into an encrypted WiFi network, they’ll be able to access only the data being transmitted from that point forward; they won’t be able to access older data.
Easy Connect
This is an optional WPA3 feature that will make it much easier for users to connect IoT devices that do not have screens — such as the Amazon Echo — to a wireless network. Easy Connect devices will have QR codes that users can simply scan to connect to their WiFi.
192-Bit Encryption for Enterprises
Unique to WPA3-Enterprise, the 192-bit security suite is aimed at public and private-sector organizations that transmit highly sensitive data over their wireless networks, such as government data, financial information, or digital intellectual property. When 192-bit cryptographic strength is enabled, the network will not allow devices to connect unless they meet an equivalent level of cryptographic strength.
How Long Until It Rolls Out?
Technically, WPA3 is already here. The Wi-Fi Alliance began certifying products in June, and we should start seeing them on store shelves before the end of the year. However, the switchover will be gradual; the transition from WEP to WPA2 took several years. While some devices will be able to transition to WPA3 with a simple software update, products that have embedded WiFi or wireless access points will have to be replaced. In the meantime, the Wi-Fi Alliance will continue to support WPA2, and WPA2 devices will be able to connect to WPA3 networking equipment.
Once market adoption of WPA3 is widespread, it will be required for all devices seeking certification from the Wi-Fi Alliance.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.