Wireless Security Explained: WEP, WPA2 and WPA3 for the Network+ Exam

Wireless security has been through four generations, and each was replaced because of a specific flaw. Understanding what broke each one is how the exam expects you to reason about wireless, and it is more useful than memorising the acronyms.

WEP and why it failed

Wired Equivalent Privacy used RC4 with a 24-bit initialisation vector. The IV is sent in cleartext with every frame, and 24 bits is small enough that values repeat quickly on a busy network.

Once IVs repeat, statistical analysis recovers the key. The practical consequence is that WEP can be broken by passively collecting enough traffic — no password guessing involved, and the key length makes no difference because the weakness is in the IV, not the key size.

WEP has been deprecated since 2004. If you encounter it, the answer is always to replace it, and finding it in use is itself an audit finding.

WPA

An interim fix that kept RC4 but added TKIP, which changed the key per packet and added a stronger integrity check. It ran on existing hardware, which was the point. TKIP was subsequently broken too, and WPA is also deprecated.

WPA2

The long-standing standard, using AES with CCMP — a genuine block cipher replacing RC4. The encryption itself remains sound.

The weakness is in the four-way handshake used to establish the session key in personal mode. An observer who captures that handshake has enough material to test passphrase guesses offline, at whatever speed their hardware allows, without ever contacting the network again.

Two consequences follow, and both are exam points. An attacker can force a client to reconnect in order to capture the handshake, so waiting is not required. And because the attack is offline dictionary guessing, passphrase strength is the only thing that matters — a long, random passphrase is not feasibly guessable, while a dictionary word or a short phrase is.

KRACK was a separate 2017 flaw in the handshake itself, fixed by patching clients and access points.

WPA3

The current standard, and the fixes map directly onto the weaknesses above.

SAE — Simultaneous Authentication of Equals replaces the pre-shared key handshake. It is a dragonfly key exchange that does not expose material usable for offline guessing, so capturing the exchange no longer enables a dictionary attack. This is the headline improvement and the most likely exam answer.

Forward secrecy means each session uses a unique key, so recovering the passphrase later does not decrypt previously captured traffic.

Enhanced Open (OWE) encrypts traffic on open networks without a passphrase, addressing the public-hotspot problem where anyone nearby can read everything.

WPA3-Enterprise 192-bit mode for high-security environments.

Protected Management Frames are mandatory, which blocks deauthentication attacks — the technique used to force clients to reconnect.

Personal versus Enterprise

	Personal (PSK / SAE)	Enterprise (802.1X)
Credentials	One shared passphrase	Per-user, via RADIUS
Revoking one user	Change it for everyone	Disable that account
Accountability	None	Per-user logging
Suits	Home, small office	Any organisation

Enterprise mode uses 802.1X with a RADIUS server, and the roles are supplicant, authenticator and authentication server. If a scenario mentions needing to remove one employee's wireless access without disrupting anyone else, the answer is Enterprise.

The attacks to recognise

Evil twin — a rogue access point broadcasting a legitimate SSID to capture traffic or credentials.
Rogue access point — any unauthorised AP on the network, often installed innocently by staff.
Deauthentication — forcing clients off so they reconnect, blocked by Protected Management Frames.
Jamming — denial of service by RF interference.
WPS attacks — the eight-digit PIN is validated in two halves, making it brute-forceable. Disable WPS.

Securing a wireless network

Use WPA3 where clients support it, WPA2-AES otherwise, and never WEP, WPA or TKIP. Use Enterprise mode with 802.1X in any organisation. Choose a long random passphrase for personal mode. Disable WPS. Enable Protected Management Frames. Separate guest traffic onto its own VLAN with client isolation. Use wireless intrusion detection to spot rogue and evil twin access points. And note that hiding the SSID and MAC filtering are not security controls — both are trivially defeated and appear as distractors.

What to remember

WEP failed because of a 24-bit reused IV, not key length. WPA2 uses AES-CCMP and is sound, but its four-way handshake allows offline passphrase guessing, so passphrase strength is everything. WPA3 replaces that with SAE, adds forward secrecy, Enhanced Open and mandatory Protected Management Frames. Enterprise mode gives per-user credentials and revocation. Hidden SSIDs and MAC filtering are not security.

Related reading: SSID, BSSID and ESSID · RSSI · Bluetooth attacks