Wi-Fi Security for Your Small Business

Anything that's offered "openly" like free Wi-Fi is vulnerable to attacks from both inside and outside your business. It's very important to take extra care and use the proper safeguards to prevent malicious attacks, stop freeloaders from stealing your bandwidth, and ensure that customers don't transfer illegal content over your network.

Let's take a look at what type of risks you can expect, what technology and personal settings you can implement to safeguard your network, and how you can protect your network from a variety of outside threats.

Risks Associated with Free Wi-Fi

Risk 1: Outside attacks. Wi-Fi hot spots are an easy target for hackers to break in and lift sensitive data from your network, whether it's your personal business files or your customers' data. Without the proper security measures in place, a hacker can easily access business information, steal a customer's identity, or infect your network with malicious software.

Solution: Make sure your router, gateway, or access point supports WPA or WPA2 (Wi-Fi Protected Access) encryption -- and always enable this feature on your wireless hardware. Customers and other authorized users will require a passcode (usually between 8 and 64 characters) to access your protected Wi-Fi network. You can post this password at your register, print it on receipts, or just offer it to customers on request.

WPA and WPA2 are the current accepted standard for Wi-Fi encryption. You'll want to make sure you're not using the older Wired Equivalent Privacy encryption method, whose outdated encryption method is extremely vulnerable to attack. Also consider changing your WPA access key on a regular basis; this will prevent users from sharing or misusing an older passcode.

Finally, always remember to use a firewall to separate your local network from the Internet. A firewall is a hardware device or software that allows users on your network to "see out" to the Internet while preventing unauthorized users from "seeing in." Most Internet routers (and all Windows PCs and Macs) use built-in firewalls, but you should always be sure these are active and properly configured before connecting to the Internet.

Risk 2: Illegal downloading and uploading. Customers may attempt to download or upload illegal content, including music and movies. Copyright holders can and often do sue users over this sort of behavior -- and if an illegal download is traced back to your public Wi-Fi network, your business may be held legally responsible.

Solution: Use a router with built-in support for blocking specific network ports, such as those commonly associated with BitTorrent file-transfer software. Some routers also allow administrators to block specific websites and/or IP addresses, although entering these manually can be a laborious task.

A number of vendors also sell software or hardware designed specifically to filter and prevent access to certain types of websites. These may include file-sharing sites, online gambling sites, pornographic content, and other websites that are inappropriate for your business and customer base. These vendors usually charge a monthly subscription fee, but they're worth considering if you want to keep tight control over how customers use your Wi-Fi connection.

Risk 3: Squatters. If your Wi-Fi signal reaches beyond your premises, it's possible for people outside your business to steal bandwidth intended for your customers.

Solution: Start by changing the default network name (also known as an SSID), login, and password for your wireless network and hardware. This information is published on various websites, making it easy for squatters to figure out your default access settings.

Next, consider disabling the "SSID broadcast" feature in your Wi-Fi hardware settings. This will make your network harder to detect unless a user actually knows the name of your network. Be aware, however, that you'll have to provide this information to legitimate customers.

Also, as noted above, enable WPA encryption support on your wireless network, and change the passcode frequently enough to discourage freeloaders who may have recorded an old passcode.

Finally, experiment with the placement of your wireless hardware to provide just the right amount of coverage -- enough to give your customers good service, but not so much that you broadcast your Wi-Fi signal to half the neighborhood.

Risk 4: Malicious sites. A number of sites your customers may be visiting on the Internet can infect your system with malware and viruses.

Solution: Stay up to date on software updates and patches for your company's computers and (when applicable) network hardware. As noted above, change the default security settings on your hardware; some malware will use these defaults to try to access these systems without permission. If you hired an outside company to set up your Wi-Fi network, arrange for someone to come back periodically to install updates and check your network for signs of suspicious activity. Of course, always make sure antivirus software and antispyware programs are running on all of your company's servers and PCs.

Also ensure that customers' computers that are logged into the public part of your company's Wi-Fi network are separated from your company's own internal systems. If you're not sure whether your networking hardware supports this capability, or if you don't know how to enable it, seek professional help. After all, even if a Wi-Fi user is a paying customer, they still pose a security risk if they're able to access your business systems or sensitive data.