Wireless Security Architecture Planner

Wireless Security Architecture Planner

Describe the wireless deployment you are planning — environment, floor area, device count, primary use, security level, and budget — and this planner produces a security architecture recommendation: which WPA protocol to standardise on, which 802.11 standard to buy for, which antenna types suit the space, an estimate of how many access points the area needs, and a security hardening checklist filtered to the assurance level you selected. The whole plan exports to PDF.

Be clear on scope before you start. This is a planning and protocol-selection tool, aligned to the wireless material in CISSP Domain 4. It does not do RF modelling, channel planning, or predictive site surveys. It will not tell you which channels to assign, how signal propagates through your particular walls, or where to mount each AP. Those require a survey tool with a floor plan and, for anything demanding, a physical walkthrough. Use this to decide your protocols, your standard, and your hardening baseline — then let a survey place the hardware.

The Six Tabs

• Deployment Profile — your inputs: environment (enterprise office, warehouse/industrial, healthcare, retail/hospitality, education campus, outdoor/public, home office), coverage area in square feet, concurrent device count, primary use (general internet, VoIP/video, IoT/sensors, guest access, point of sale, mixed), security level (basic, standard, enhanced, maximum), and budget tier.
• Protocol Comparison — WEP through WPA3-Enterprise side by side, with encryption, key management, authentication, known vulnerabilities, and a security score.
• 802.11 Standards — 802.11a/b/g/n/ac/ax/be compared on band, maximum rate, typical range, channel width, and MIMO capability.
• Antenna Selection — omnidirectional, Yagi, parabolic dish, panel/sector, and patch, with gain ranges, pros and cons, and which environments each suits. The list is filtered to your selected environment.
• Security Checklist — seventeen hardening items, shown according to the assurance level you chose, as a working checklist.
• Summary & Export — the full recommendation, with PDF export.

Protocol Selection: What the Recommendation Means

The security level maps to a protocol: Basic gives WPA2-Personal, Standard gives WPA3-Personal, Enhanced gives WPA2-Enterprise, and Maximum gives WPA3-Enterprise. The reason Enterprise outranks a newer Personal variant is authentication architecture, not encryption strength.

Personal versus Enterprise is the decision that matters most. A pre-shared key is one secret shared by everyone. Anyone who has it can decrypt traffic, you cannot revoke one person’s access without rotating it for everybody, and it walks out of the building on every departing employee’s phone. Enterprise mode replaces it with 802.1X authentication against a RADIUS server, giving each user or device its own credential, individual revocation, per-session keys, and an audit trail. Any network with staff turnover should be Enterprise.

WPA3-Personal’s real improvement is SAE (Simultaneous Authentication of Equals, the “Dragonfly” handshake), which replaces WPA2’s four-way handshake. Under WPA2, an attacker can capture the handshake and run an offline dictionary attack against the passphrase at whatever speed their hardware allows. SAE makes the exchange resistant to offline cracking, so a captured handshake is not a cracking target, and it provides forward secrecy — recovering the passphrase later does not decrypt previously captured traffic. Dragonblood side-channel weaknesses were found in 2019 and have been patched.

Note the practical caveat: WPA3 transition mode, which runs WPA3 and WPA2 simultaneously for compatibility with older clients, gives you WPA2’s exposure for any device that connects that way. If you need transition mode, treat the network as WPA2 for risk purposes.

The AP Count Estimate — and Its Limits

The planner estimates access point count from coverage area and environment. It assumes a per-environment effective radius — 20 m for a home office, 25 m for healthcare, 30 m for an enterprise office or retail, 35 m for education, 40 m for a warehouse, 50 m outdoors — treats each AP as covering a circle of that radius, converts your square footage to square metres, and applies a 1.3× factor for the overlap that roaming requires.

This is a first-order sizing figure for a budget conversation, and you should treat it as exactly that. It does not model wall materials, floor-to-floor bleed, interference from neighbouring networks, or client density. In practice, density often drives AP count more than area does: a 200-seat lecture hall may need several APs in a space the area formula would cover with one, because each radio can only serve so many concurrent clients before airtime contention degrades everyone. The healthcare and warehouse radii in the model reflect a rough allowance for construction — dense interior walls and steel racking respectively — but a real number needs a survey.

Standard and Antenna Guidance

The standard recommendation follows budget and use: enterprise budgets go to 802.11ax (Wi-Fi 6/6E); mid-range goes to Wi-Fi 6 for VoIP/video and mixed use and Wi-Fi 5 otherwise; IoT deployments are pointed at 802.11n, since sensors rarely need more and older radios cost less. The value of Wi-Fi 6 in a busy environment is not headline speed but OFDMA and improved MU-MIMO, which let one AP serve many clients efficiently — the density problem, not the throughput problem. Wi-Fi 6E and Wi-Fi 7 add the 6 GHz band, which is uncongested but shorter-range, so it changes AP placement rather than reducing AP count.

Antenna guidance is filtered by environment: omnidirectional for even coverage from central placement, patch antennas for wall-mounted and aesthetically sensitive spaces such as healthcare, panel/sector for corridors and outdoor sectors, Yagi for point-to-point and warehouse aisles, and parabolic dishes for long-distance links. Higher gain always means a narrower beam — gain does not create signal, it reshapes it.

The Security Checklist

Seventeen items are filtered by assurance level, ranging from universal basics (change the default SSID, disable WPS, disable legacy 802.11b, schedule firmware updates) through standard controls (802.11w management frame protection, separate wireless VLAN, isolated guest VLAN with AP isolation, monitoring and logging, documentation) to enhanced and maximum measures (WPA3/WPA2-Enterprise with RADIUS, EAP-TLS certificate authentication, wireless IDS/IPS for rogue AP detection, periodic audits, RADIUS redundancy).

Two items are deliberately marked as supplementary, and the labels are honest about it. MAC filtering is trivially defeated — MAC addresses are transmitted in the clear and can be spoofed in seconds — and disabling SSID broadcast merely omits the name from beacons while it remains visible in every association frame. Neither is a security control on its own; both add administrative friction. They appear at higher assurance levels as defence-in-depth, not as substitutes for authentication.

Related Tools

Plan the VLAN addressing your wireless segments will need with the subnet calculator, model the segmentation rules between them with the firewall rule simulator, and generate strong PSKs where Personal mode is unavoidable with the secure password generator.

Frequently Asked Questions

Should I use WPA3 or WPA2?

WPA3 where your clients and hardware support it, for SAE’s resistance to offline passphrase cracking and its forward secrecy. If you must run transition mode for older clients, assume WPA2-level exposure for those connections.

What is the difference between Personal and Enterprise?

Personal uses one shared passphrase for everyone. Enterprise authenticates each user or device individually against a RADIUS server via 802.1X, giving per-user revocation, per-session keys, and auditability. Any organisation with staff turnover should use Enterprise.

How many access points do I need?

The planner gives an area-based estimate with a 1.3× overlap allowance. Treat it as a budgeting starting point. Client density, wall construction, and interference frequently push the real number higher, and only a site survey settles it.

Does this tool do channel planning or a site survey?

No. It recommends protocols, standards, antenna types, and hardening controls, and estimates AP count from area. It performs no RF propagation modelling, channel assignment, or predictive survey.

Is hiding my SSID worth doing?

Not as a security measure. The network name still appears in association frames and any wireless scanner will find it. It appears at higher assurance levels as a minor obscurity measure only.

Does MAC filtering help?

Marginally, and only as defence in depth. MAC addresses are sent unencrypted and are easily spoofed. It is listed as supplementary for exactly this reason.

Is Wi-Fi 6 worth it over Wi-Fi 5?

In high-density environments, yes — OFDMA and improved MU-MIMO let one AP serve many clients far more efficiently. In a sparse deployment with few clients, the practical gain is much smaller.

What does the PDF export contain?

Your deployment profile, the recommended protocol and 802.11 standard, the estimated AP count, the suitable antenna types for your environment, and the filtered security checklist — suitable as an appendix to a design document.