Wi-Fi Security in Business: Essential Tips from ANSSI to Protect Your Network

Following a summer characterized by numerous cyber attacks that impacted French government bodies and businesses, the National Agency for the Security of Information Systems (ANSSI) released a new guide on Monday, August 31, 2026, focused on securing Wi-Fi networks, as part of their series titled The Essentials. This guide divides over twenty best practices into three sections, covering individual professional workstations to the deployment and management of a corporate network.

Unadvisable habits on a professional workstation

This first section is aimed at users of professional workstations. ANSSI advises turning off the Wi-Fi interface and connection sharing when not in use, as well as disabling automatic connections to previously known Wi-Fi networks. Only networks managed by the company should be used.

When traveling in locations like train stations, airports, or cafes, the agency suggests activating a VPN service managed by your organization instead of using public Wi-Fi.

Additionally, the local firewall should block incoming connections. Before reconditioning, transferring, or decommissioning a device, all known networks and their associated secrets should also be erased.

Guidelines to follow on a company’s Wi-Fi network

This second section targets teams responsible for deploying the Wi-Fi network within a company. ANSSI recommends:

• avoiding the use of personal Wi-Fi access points in a professional environment;
• using strong security modes, such as WPA3-Enterprise, WPA2-Enterprise under specific conditions, or WPA3-Personal, while avoiding mixed mode WPA3/WPA2, which compromises the security of WPA3-compatible devices;
• limiting the distribution of connection secrets to authorized personnel and changing them regularly.

Expectations from network administrators by ANSSI

This third section is directed towards network administrators. The agency recommends logging connections from access points and Wi-Fi controllers to a central supervision infrastructure, and changing default login and administration usernames and passwords.

Administration protocols should also be secured using TLS or SSH, and the administration interface should be connected to a separate, segmented network. Another crucial point: updates to operating systems, drivers, access points, controllers, and devices must be implemented without delay.