Quick Links
Hiding your Wi-Fi network name, the Service Set Identifier (SSID), doesn’t provide the cybersecurity protection one might expect. So, why doesn’t concealing the Wi-Fi network ensure its safety, and what steps should you take to secure your network?
Why Hiding Your Wi-Fi SSID Doesn’t Secure Your Network
Have you ever searched for Wi-Fi and stumbled upon those “hidden” networks in your list of available connections? Chances are, you noticed that these networks are not entirely invisible despite their names being hidden.
Hiding your Wi-Fi network’s SSID (Service Set Identifier) involves configuring your router to stop broadcasting the network’s name. The feature is common on most Wi-Fi-enabled routers and your smartphone Wi-Fi hotspot.
In the example above, a hotspot has been created with the name “MyNetworkNameIsHidden,” and the option to hide the SSID has been selected. When connecting to the network on a computer, it shows up as a “Hidden Network.” To connect, the full SSID must be typed in manually.
This is an example of “security by obscurity,” which unfortunately doesn’t offer much protection. While the network’s nameishidden, as you may see, it’s not invisible.
In reality, hiding the SSID is ineffective against hacking tools such as network sniffers and analyzers like Wireshark or Airmon-ng. These tools easily detect and exploit hidden networks by intercepting data packets that are transmitted even when the SSID is hidden.
A hidden SSID can also increase the noise floor—the baseline level of interference in a wireless environment. The effect in large offices or apartment buildings is even worse and degrades network performance.
Also, hiding the SSID causes compatibility with some older and IoT devices, such as smart home technology.
Given these shortcomings, it’s clear that hiding your SSID is not the cybersecurity silver bullet it’s often thought to be. So, how do you really protect your Wi-Fi network?
1. Change the Default Password and SSID
Your router will often come with a preprogrammed password (you can usually find it printed on the bottom of the device). Usually, the password is a series of up to 10 numbers. First, you shoulduse a password creation toolto create a more complex password.
Use a combination of lower and uppercase letters, numbers, and symbols. While you’re at it, changing the SSID itself is also recommended and allows you to come up with something creative. Remember not to use any name that could identify the physical location of your router.
2. Update Wi-Fi Encryption
Wi-Fi encryption effectively scrambles your data so it cannot be read by anyone else. OlderWi-Fi encryption protocolssuch as WEP and WPA can easily be cracked with hacking tools, and even the most commonly used WPA2 protocol has vulnerabilities.
Modern routers have WPA3 encryption, but WPA2 is generally selected by default for compatibility reasons. However, if your router supports it, you should use WPA3 encryption. If you have issues with older devices being unable to connect, you can usually select a combination of WPA2/WPA3.
3. Update Your Router Firmware
Just like your smartphone and computer, network devices have regular security patching and updates.Wi-Fi router firmware updatesare generally found in your router’s system settings and will require a reboot of the device after installation.
Neglecting these updates leaves your network hardware vulnerable to any threats discovered since the device’s manufacture.
4. Network Monitoring and Intrusion Detection
Noticing someone new living in your home is pretty obvious. You know your friends and family and can spot a stranger. Keeping an eye on who and what is using your Wi-Fi network is a little more complicated but just as important.
You canuse a smartphone app to check if your network is secure, scan the network you’re connected to, and convert the devices' physical address (MAC address) into friendly names, so they’re easy to recognize.
If you see any devices that you don’t recognize, you can remove them using your router’s settings.
5. MAC Address Allow Listing
This method (also known as “whitelisting”), which can be set up on most routers, only allows a device to connect to your network if its MAC address has been pre-approved.
Every device has a unique MAC address and can usually be found within its settings or on a label located on the device itself. When the allow list is enabled, any device not on the list will be unable to connect to your Wi-Fi network.
6. Network Segmentation
Separating your home network into segments, sometimes known as “subnetting,” is a great way to keep sensitive information away from devices already connected to your Wi-Fi.
Each segment generally has access control rules, meaning certain devices in one segment can’t communicate with devices in another.
An example is having your smart home devices on one subnet so they cannot access information on another device, such as a home storage server or NAS. Another common implementation is the captive portal, or guest Wi-Fi network, which generally does not require password authentication but is separate from the main network.
7. Turn Off WPS
You might have noticed your router has a button on it labeled WPS. This feature bypasses password security and allows you to connect with the touch of a button.
Wi-Fi Protected Setup (WPS) was designed with the theory that if you’re close enough to the router to press a button, you might as well be allowed to connect to it. It’s a little like leaving the house key under the doormat; it’s convenient, but it represents a big security risk. It’s best to disable this feature and let password authentication do its job.
