Wireless Security Architecture: A Reference Design

Abstract. A reference architecture for enterprise wireless security covering WPA3 migration, 802.1X with certificate validation enforcement, per-device PSK for IoT, segmentation policy and the operational controls that make the design hold.

Design principles 1. Identity over topology. Access is determined by who or what the device is, not which SSID it joined. 2. Minimum SSIDs. Four maximum; use RADIUS assigned VLANs for differentiation. 3. Assume IoT compromise. Design for containment, not prevention. 4. No client side trust decisions. Users must never be asked whether to trust a certificate. SSID architecture SSID Authentication Clients Segmentation CORP WPA3 Enterprise, EAP TLS Managed laptops, phones Dynamic VLAN by RADIUS DEVICE WPA3 Personal, per device PSK IoT, printers, telemetry VLAN per device class BYOD WPA3 Enterprise or onboarded PSK Personal devices Restricted service VLAN GUEST OWE (Enhanced Open) Visitors…