Wireless LAN Security
Legacy to modern
WEP (RC4, 24-bit IV) is broken and must never be used. WPA added TKIP with a Michael MIC as a firmware stopgap. WPA2/802.11i uses CCMP with AES-128 and is the baseline. WPA3-Personal replaces the PSK handshake with SAE, defeating offline dictionary attacks, and adds OWE for open networks plus an optional 192-bit Enterprise mode.
Personal vs Enterprise
Personal (PSK/SAE) derives a PMK from a passphrase of 8–63 characters. Enterprise uses 802.1X with EAP and a RADIUS server: the supplicant and server authenticate, then the AP and client run the 4-way handshake to derive the PTK, while the GTK protects broadcast and multicast. EAP-TLS is strongest (certificates on both sides); PEAP and EAP-TTLS use a server certificate plus an inner method; LEAP is obsolete.
Attacks and mitigations
Know evil twin and rogue APs, deauthentication/disassociation floods, MAC spoofing and client misassociation. Mitigations include WIPS/WIDS with containment, 802.11w management frame protection (PMF), strong segmentation and disabling unused SSIDs. SSID hiding and MAC filtering are obscurity, not security.
Traps
Believing WPA2-Personal encrypts the SSID; confusing the 256-bit PMK with the derived PTK; assuming shared-key authentication is stronger than open; and forgetting PMF is required for WPA3.
Rule of thumb
If a design needs per-user accountability, auditing or revocation without distributing a shared secret, it must be Enterprise (802.1X/EAP), not PSK.