Awareness Day Sixteen: Access Control - Wi-Fi and Network Access
Awareness Day Sixteen: Access Control - Wi-Fi and Network Access
Some considerations for Wi-Fi best practice in schools:
- Active Monitoring - ensure all your access points are working and switched on. In a school access points are often unplugged by other members of staff due to the layout of the building when there is a classroom move around.
- Wireless Management - consider the use of wireless management which offers more than configuration and logging.
- Prioritise Usage - if allowing casual use by staff/visitors for their mobile phone, ensure that critical applications, such as VoIP (phone system) and admin systems get priority over non business usage.
- Guest Policies - consider a guest Wi-Fi network where the password can be shared for visitors and guests/contractors where the network resources are restricted, i.e no access to printers or network files. Change the guest password regularly. If you are part of a Trust that has central staff that move between schools regularly, set up a 'Trust Wi-Fi' so that their devices connect at each location smoothly and with the correct access. Don't make the password the name of the establishment or Password123, ensure it is appropriate.
- Firmware Updates -Ensure the firmware on the router is kept up to date to help prevent a cyber attack.
- Ensure any default user names and passwords have been changed for the access points.
- Have a unique SSID (Service Set Identifier) and ensure it's not easy to guess.
- Ensure the data on the Wi-Fi network is encrypted by using Wi-Fi Protected Access (WPA), WPA2 and WPA3.
- For larger systems, consider installing a firewall.
- Review the NCSC Wi-Fi Guidance
- Review the DfE Wi-Fi Network Standards for Schools and Colleges.
Source of information: Article: EdTech Best Practices Implementing New Wireless Network
Source of information: CISA Securing Wireless Networks
More questions like these are in our Information and Cyber Security Checklist (only viewable with a valid Data Protection Education subscription):