Enterprise, SMB, SOHO and Public-Network Security Design Models
Design by scale
Enterprise: WLC-based deployment (CAPWAP split-MAC, cloud or distributed), redundant controllers, RADIUS/AAA with EAP-TLS for managed devices, role-based access control mapped to VLANs and ACLs, a dedicated guest SSID anchored in a DMZ, WIPS overlay, NAC with posture assessment, and MDM for BYOD certificate provisioning.
SMB: fewer SSIDs, controller-less or cloud-managed APs, WPA2/WPA3-Personal or PSK plus 802.1X if a RADIUS server exists, separate guest VLAN, basic rogue detection, firmware discipline.
SOHO: WPA3-Personal or WPA2-PSK, changed admin credentials, WPS disabled, current firmware, guest isolation. Hidden SSIDs and MAC filtering are not security controls.
Public/hotspot: open network with OWE or a captive portal on an isolated guest VLAN, client isolation, rate limiting, no path to internal resources, and encryption supplied by the application (TLS) or a VPN.
Traps
A guest network separated only by VLAN but not firewalled is not isolated. A captive portal is an access convenience, not encryption. PSK on a large WLAN gives one shared secret with no per-user accountability or revocation. Controller-based designs tunnel data unless local switching is configured. Enterprise voice needs fast roaming and PMF, which a consumer SOHO design cannot deliver.
Worked example
A 40-person office with no PKI wants the strongest practical design. Answer: WPA2/WPA3-Enterprise with PEAP-MS-CHAPv2 and enforced server certificate validation, or WPA3-SAE if no RADIUS exists; separate isolated guest SSID; changed defaults; PMF enabled; documented onboarding.