If your staff wireless uses a shared passphrase, everyone who has ever worked for you still has access, along with their contractors, their families and anyone who photographed the card on the wall. A password with no owner cannot be revoked, so the control degrades every month while appearing to work perfectly. NIST’s guidance on robust wireless security networks in SP 800-97 treats per-user authentication as the goal for exactly this reason.
Changing a shared key means touching every device that uses it, and in most offices nobody has a complete list of what that includes. Laptops and phones are the visible part. Behind them sit tablets in meeting rooms, wireless printers, barcode scanners, smart displays, environmental sensors and a handful of machines whose owners left years ago. A change on Monday morning produces a queue at the service desk and at least one operational surprise, so the rotation gets deferred, and deferral becomes policy without anyone deciding it.
What an attacker does with it
Capturing the material needed to attack a passphrase takes minutes from a car park. A tester waits for a device to connect, or nudges one into reconnecting, and takes the handshake away for offline cracking where there is no lockout and no alerting. A passphrase built from the company name and a year falls in seconds on ordinary hardware. Once connected, the attacker is on your staff network with whatever access that network provides, which in many offices is a direct route to file shares and internal applications.
“Ask when the wireless password was last changed and who currently knows it. If the answer to the first question is a year with three digits and the second is everyone, the key is not protecting the network, the segmentation behind it is. That is worth knowing, because most people believe the opposite.”
William Fieldhouse, Director, Aardwolf Security Ltd
Moving to something you can revoke
Enterprise authentication with per-user credentials is the destination, and certificate-based 802.1X is the strongest form of it because there is no password to share. Where devices cannot support it, several wireless platforms offer per-device keys, sometimes called identity or private pre-shared keys, which give each device its own passphrase on the same network name. That removes the shared secret without a change of infrastructure, and it lets you revoke a single device when somebody leaves rather than rotating a key for the whole building.
See also: Drywall Repair Techniques for Long-Lasting, Professional Results
Living with a shared key in the meantime
If rotation is the only option available this year, plan it properly. Build the device inventory first, choose a long random passphrase rather than a memorable one, schedule the change for a quiet period, and communicate it in advance with clear instructions. Rotate on a fixed annual date and immediately after anyone with privileged access leaves. Behind that, assume the key is known and make sure the network it protects reaches as little as possible, then verify with wireless network security testing and internal penetration tests that the segmentation you are relying on genuinely holds.
Frequently asked questions about shared wireless keys
These questions come up whenever a wireless refresh is being considered.
Does WPA3 remove the problem?
It makes offline cracking far harder, which is a real improvement, and it does nothing about the fact that everyone knows the password. Revocation, not cracking difficulty, is the underlying issue.
How long should a passphrase be?
Long enough that offline attacks are impractical, which in practice means a random string of twenty characters or more. Nobody types it twice if it is stored in your device management platform anyway.
