By Rob Fischer

Why Secure Your Home Wi-Fi?

We put a lot of trust in our home networks every day. We connect our smart phones to them, we connect our laptops and desktops to them, we connect our streaming devices and gaming consoles to them, and many times we even connect our appliances and thermostats to them! All of these things contain our personal data, and as such, are targets for cyber criminals. Our home networks can contain a literal treasure trove of information, worth thousands of dollars in the wrong hands, so it makes good sense to protect it as best as we can.

Wi-Fi is especially vulnerable to attack. Wi-Fi works by sending data over a radio-frequency signal, just like any other form of mobile, wireless communication. Because of that, we say that it is a ‘common’ or ‘shared media.’ That’s really just a fancy way of saying that unlike a wired, cabled connection where you have to physically be able to plug into it to be able to hear what is going on, with Wi-Fi, you just have to be somewhere in range – there is no physical barrier at all. And you’d be surprised just how far a Wi-Fi signal can travel. In some cases, they can carry for a mile or more!

What that means is that if you aren’t taking some proactive steps to secure your Wi-Fi, an attacker can be sitting around the corner from your house where you can’t even see them, perhaps even parked at the corner store down the street, and with the right tools they can ‘sniff’ or listen in on everything that happens on your network. They might be able to reconstruct the data that you’re sending – what documents you’re printing, what usernames and passwords you’re entering, what websites you’re visiting, and more. They might even be able to gain persistent access to your network and install malware on your devices to cause further harm.

Protecting your Wi-Fi is a must.

Wi-Fi Security 101

Fortunately, there are some basic steps that you can take to make your home network in general, and Wi-Fi in particular, more secure. Some of these might sound a little daunting, but I promise, most modern routers will make many if not all of these pretty straightforward to do, and the benefit that you’ll get out of it is well worth the effort!

First, I’ll go through 10 of what I consider to be the most basic and essential steps that everybody should take to secure their home network’s Wi-Fi. Later I’ll add on a few ‘extras’ that you might consider tackling down the road, but if you can accomplish this ‘top 10’ you will have taken some major strides toward making your home Wi-Fi much more secure – a noble and worthy goal!

A few quick notes before we get started:

I will use the terms ‘router’ and ‘access point’ interchangeably in this article. Technically they are different things – a router is what tells different devices on your network how to talk to each other and to the Internet, and an access point is a fancy antenna that broadcasts and receives a Wi-Fi signal to establish a wireless network. In an ‘Enterprise’ (i.e. corporate or industrial) set up, those are often two different devices. In your home, however, they are almost always going to be one and the same; probably, the box that you got from your internet service provider (which in many cases may mean that it is a ‘modem’ as well, technically a third type of device!), or the one that you bought that you’ve plugged into the one that you got from your ISP. Though I will use the terms interchangeably, I will typically use ‘router’ when I am talking about something that will impact your entire network and ‘access point’ when it is something that is likely to be Wi-Fi specific. Just keep in mind that I am talking about the same physical device.

I will also use quite a a few acronyms and abbreviations. Where it is important, I will define them, but in many cases I won’t, for sake of brevity and to avoid confusion. If you’re curious, I strongly encourage you to look them up! The worlds of networking and security are fascinating, and knowledge is power.

These ten basic steps are all things that every router worth its salt should be able to do. In fact, if your router/access point can’t do these things, I would seriously consider an upgrade! Most commercial routers/access points will also make all ten of these things easy for a non-tech-savvy person to do. Still, if in doubt, I strongly recommend taking the time to read any tool tips, help pages, or manuals that you might have available to you as you go along – they will provide a wealth of information, and it is often a lot easier to do things right the first time than to have to figure out how to fix them later!

Are you ready? Here we go!

10 Basic Steps For Securing Your Home Wi-Fi

1. Change the default administrator account name and password. This first step is the most basic thing that you can and should do the minute that you start setting up your home Wi-Fi network. Every router is going to come with a default administrator account, usually called “admin” or “administrator.” Those accounts are well-documented and any potential hacker is going to be able to look them up based on the model and manufacturer of your router, so changing the name of the account (if you can) or setting up a new account altogether and disabling the default one (if you can’t rename it) makes it much harder for an attacker to be able to log in to your router and start making changes. As with all important passwords, choose one that is hard to guess and includes special characters and numbers, and of course, the longer the better. We at Breach Be Gone recommend using passphrases rather than passwords, since they can be made longer more easily, and are easier for you to come up with and remember while still being difficult for an attacker to guess!
2. Change the default network name and password. While you’re changing the default administration credentials, why not change the Wi-Fi’s name and password while you’re at it? The name that a Wi-Fi network goes by is called its ‘SSID,’ and you should change it to something unique, at least for your immediate area. Some guides will recommend hiding your SSID, but I personally don’t recommend such a step – it is very easy for attackers to find ‘hidden’ SSIDs (I do it all the time), and it just makes it less convenient for you to connect to your own network without adding any security benefit. What you should do, however, is change the password on your network to one that is at least 12, or better yet 15, characters long and is hard to guess (i.e. it should have nothing to do with the network name/SSID). In most cases you’ll only have to enter the password once per device that you connect, so setting up a complicated password won’t be that much of a pain for you, but it will make it much harder for the bad guys to get in, so consider using a password generator to come up with a tough one! Hopefully it goes without saying, but this password should be different from the one that you chose above, as well. 
3. Change your network’s access password, and your administrator account’s password, semi-regularly. I know that you just set them, and I’m already telling you that you need to change them. It can be annoying, but just like any other password, you’ll want to change these periodically. You don’t need to do it every 90 days or anything crazy like that. In fact, if you make them good (16 characters or longer) you can go about a year before you really need to change them. But, once you hit that year mark, you really do need to cycle them out – that way, if somebody were to guess them or crack them somehow, they’d have to start back over from scratch. The way that I manage this is just to set a reminder in my phone. When it goes off, I change my smoke detector batteries and cycle my router’s admin password. Of course, if you suspect somebody might have gotten access to your account or to your network, you should change all of your passwords right away, even if it hasn’t been a year yet!
4. Ensure you’re using strong and modern encryption. Don’t worry, this is much easier than it sounds! Most routers will give you the option of choosing between a number of different “authentication types” or something similar. If you have the option to pick something called WEP, don’t (and consider upgrading your router); WEP has many known vulnerabilities and can be ‘cracked’ in a matter of seconds in some cases! WPA isn’t quite as bad but it is also deprecated and insecure and I don’t recommend it, either. WPA2 is better and is the minimum you should use, and WPA3 is better still so if you have that option, choose that. If you have the option to pick, choose a ‘key length’ of 128 or higher; if you don’t, then don’t worry about it. As long as you’re using WPA2 or better and have picked a good password, you ought to be okay in most circumstances. 
5. Place your access point (a.k.a. router) in a central location, and if you can, turn down the broadcast power to the minimum you need. Believe it or not, this may actually improve performance, as well as enhancing security! Most homes have their access points broadcasting many times more powerfully than they need to be because they place their routers in bad locations. This makes it much easier for an attacker to sit at a distance and take their time cracking your passwords and getting access! This process might take a little trial-and-error, but it can be well worth the time. The more centrally you can place your router, the better coverage you will get inside your apartment or house. Then, you can start slowly turning down the broadcast power (if your access point gives you that option) until your devices at the edges at your house have about ½ strength signal or so – you don’t need ‘full bars’ all across your house for good performance, as long as you aren’t getting interference, and you don’t want to be beaming your data to the park across the street where somebody can hack your home network from the comfort of their van! Even if you can’t place your access point centrally, you should still turn down your broadcast power as low as you can without losing performance. Always test in the room farthest from the access point, or with the most walls in between, as that will be where you’ll experience the most loss. 
6. Set up your router’s firewall. Your devices will each have a firewall of their own, but why stop attackers there if you can stop them farther ‘upstream’ at the router? You should follow your router’s how-to guides to make sure that you are setting things up correctly, but there are a few best-practices that I recommend. First, you should follow the principle of ‘deny by default, allow by exception.’ You don’t want to think about what specifically to block, you want to block everything and think about what specifically to allow. Every service that you use will have a documented ‘port,’ expressed as a 2, 3, or 4 (rarely 5) digit number, that it will communicate on. Those are the only ports that you should allow through. If possible in your firewall’s capabilities, you should only allow those ports to those specific devices (e.g. port 123 to device 192.168.1.10 and no other), but that may be a little advance for some routers or some networks. If that is the case don’t worry; just get your firewall up and going as best as you can, allowing only the ports that you have to. 
7. Turn on the ‘guest network’ feature and set it up with a password as well. Nearly every commercial router now supports setting up a guest network, and most make it very easy. You should take advantage of this feature! Using a guest network means that you don’t have to share your password with guests, which keeps it more secure. Guest networks are usually also set up automatically to have more restrictions at the firewall and less access to things like router management, which is also a more secure configuration by default. Nevertheless, you should still set up a password for your guest network, because you’ll still want to control who can and can’t log on to it. 
8. Set up automatic firmware updates on your router, or regularly check for and apply updates manually. As with any other piece of software, your router’s firmware will occasionally be updated to improve performance or to patch any discovered security issues. You should enable automatic updates if your router supports them, or set yourself a reminder to check for them manually every so often if if doesn’t support automatic updates. 
9. Turn off risky features such as WPS (aka push-to-connect), UPnP, and remote management. Some routers have a ‘feature’ that allows you to push a button on the front when you want to connect a new device without having to enter a password. Sounds convenient, right? It is, and it also has some well-documented security holes that attackers can use to waltz right in to your network just as conveniently. Disabling WPS shuts down that whole avenue of attack. Universal Plug and Play (UPnP) is another convenience ‘feature’ that doesn’t really do much to help you but that does make it easy for an attacker to exploit well-know security flaws to gain access to your network. Turn it off as well. Finally, you want to make sure that only you can sign in to your router to make changes. Limit administrator logins to only wired connections (rather that wireless), or to only specific devices, if you can and if it is feasible for you. At minimum, at least disable remote management; that is to say, do not allow anybody connecting over the internet to be able to log in to your router as an administrator. Local connections only! In many cases this will be the default setting, but it is always good to check!
10. Routinely check which devices are connecting to you network. Many of us set up our routers when we first move in, and then never log in to them again. “If it ain’t broken, don’t fix it,” right? Well, in that case, somebody could be connected for years and we’d never know it! We don’t necessarily need to check daily, or even weekly, but it is a good idea to check every so often and review what devices are connected to your network – do you recognize all of them? Do a quick count. Can you account for everything that you see connected? If you can’t, there is a chance that somebody is connected who shouldn’t be, and it might be time to change your password!

A Few More Things You Might Be Able To Do

These are some more intermediate-to-advanced steps that you might consider taking once you have the basic ‘top ten’ above all squared away. Even though these might seem a little harder, I strongly believe that guided by good documentation, your average somewhat-tech-savvy person can likely make a good effort toward accomplishing all 6 of these things! The only caveats that I would add are that not all routers are going to support all of these features, and even if they do, they might not have good enough documentation or how-to guides for you to be able to figure them out.

The ‘top ten’ basic steps above are things I would consider to be essential. These following six I would important but not essential, so if you aren’t quite sure what you’re doing or if you aren’t comfortable with the guides you’re reading, it might be better to err on the side of caution. If you have a nerdy friend who can help you out, now might be a good time to bring her around to lend a hand. If not, don’t worry! Even if you never get around to these six, as long as you have the previous ten well in hand, you are well ahead of most folks on your block.

Without further ado, here we go!

1. Set up a separate VLAN or subnet for ‘IOT’ devices. Sound like gobbledygook? This might be a little advanced for some users, but some routers might have good how-to guides to walk you through how to do this (my personal favorite pfSense does, for instance). IOT (or internet or things) devices such as doorbell cameras, smart appliances, and similar are notoriously insecure and putting them on a separate network – kind of like a guest network but even more limited – is a great idea. That way, if they ever do get compromised, the attackers will find it that much more difficult to ‘laterally traverse’ (a fancy way of saying ‘move around inside of’) your network to gain access to their real target: your personal data on your computers or smart phones. 
2. Use a ‘DMZ’ for streaming devices. Similar to the subnet/VLAN we set up for IOT devices above, but a bit more of a special case since streaming devices sometimes need special firewall rules to work correctly that can be difficult to set up just right. Putting them in a ‘DMZ’ (short for ‘demilitarized zone,’ an analogy in this case that highlights the fact that we’re putting the device out in a no-man’s-land of sorts) sets them outside of most firewall rules, but also outside of your local network so that they can’t really do much harm if they do get compromised. Many modern routers make it easy to set up a DMZ and assign devices to it. Check the documentation of yours for details, and follow their recommendations. 
3. Set up MAC address filtering. A MAC address is unique identifier that every device that connects to a network will have. Unlike an IP address, it will usually remain constant no matter what network a device connects to. You can set up your network to only allow pre-approved (also know as ‘whitelisted’) MAC addresses to connect. What that means is that you can make it so that even if an attacker were able to compromise your password somehow, they still might not be able to connect! This kind of thing also gets called “port security” on corporate networks, but on most home routers it will be called ‘MAC filtering.’ The best way to set it up is to connect every device you want to have joined to your network before turning it on, so that you can add them all to the ‘whitelist’ as soon as you set it up. You’ll also want to make sure that you have a guest network set up, so that you don’t have to add the MAC of every visitor who drops by – but you did that earlier in step 6 up above, right?
4. Add a VPN to your router itself. Even better than having a VPN on each individual device on your network is to have one on your outbound network connection itself! Most VPN services will support this, and many have their own how-to guides on how to set it up. You’ll also want to consult your router’s documentation, to make sure that you get all of the configurations correct so that you send all of the internet-bound traffic through the VPN and don’t get any ‘leakage.’ But, once you have it set up, you will gain a little extra privacy and security knowing that all of the internet traffic coming out of your home network will be tunneled through a VPN!
5. Set up a schedule for when your network will broadcast, and when it won’t. Not all routers support this feature, but if yours does, it is a great way to secure your network and save a little bit of energy as well. If you know you won’t be home during the day on most weekdays, then why not schedule your Wi-Fi to automatically turn off during that period? If you know that you’re going on vacation and won’t have any guests over, why not disable your guest network while you’re gone? There are all kinds of ways that you can limit access to your network using technical controls, but the simple act of turning it off when not in use is a severely underrated best-practice. 
6. Choose wired connections where possible. This may not always be feasible, depending on your set-up, but if you have the ability to cable up your desktop, gaming console, streaming device, and other high-use devices, you’ll get better performance as compared to Wi-Fi alongside greater security, at least on those devices. There will be that must less traffic for a potential attacker to try to ‘sniff’ and intercept. In conjunction with step 8 above (disabling remote management), this can really lock down an attacker’s options, even if they manage to get access to the wireless traffic by cracking its encryption password. 

Conclusion

Whew, you made it! I know it sounds like a lot, but fortunately most of these steps are things that you really only need to do once, and even those that you do need to check in on periodically don’t take up that much time. These steps are a great starting point to making your home network much more secure, but you should also check out some of the other articles that we have here at Breach Be Gone to further enhance your personal digital security, such as learning how and why to use a VPN, how to choose good passwords (and why passwords along aren’t enough!), how to practice good ‘cyber hygiene,’ and more!

Further Reading

Some tips from the FCC: https://www.fcc.gov/consumers/guides/how-protect-yourself-online

Similar tips from the FTC: https://consumer.ftc.gov/node/78375

A glossary of useful router & networking terms (and an example of what good router documentation looks like!) https://docs.netgate.com/pfsense/en/latest/glossary.html