Session 5: Networks & Wi-Fi Security

A typical Nigerian home or small-office network has one device doing several jobs. The router connects your local network to the internet and decides where traffic goes. It usually contains a switch, giving wired ports, and a Wi-Fi access point, giving wireless. It also runs DHCP, which hands out local addresses automatically, and NAT, which lets all your devices share the single public address your provider gave you.

Understand the two address spaces, because the distinction matters. Private addresses — the 192.168.x.x range most routers use — exist only inside your network and are how your devices talk to each other. Your public address is what the internet sees. NAT is the boundary between them, and it is the reason a device on your network is not directly reachable from outside by default — which is a genuine, if unglamorous, security benefit.

This model explains most network security advice. A device on your local network can reach every other device on it, which is why an infected laptop is a risk to the printer and the phone. A guest on your Wi-Fi is inside that boundary, which is why guest access matters. And anything reachable from the internet is reachable by anyone who finds it, which is why port forwarding and remote administration deserve suspicion.

Routers ship configured for convenience, not security, and the defaults are the single largest source of home and small-business network exposure. The admin password is printed on a sticker and is the same on every unit of that model, so anyone who knows the model knows how to get in — and once inside, they can redirect traffic, change DNS, or open the network. Changing it is the first and most important action.

The Wi-Fi password is likewise on the sticker, visible to anyone who sees the router, and often shared freely with visitors who never leave. WPS — the push-button pairing feature — has known weaknesses and should be disabled. Remote administration lets the router be configured from the internet, which almost nobody needs and which should be off. UPnP lets devices open ports on the router automatically, which is convenient and which malware also uses.

Then the firmware, which is the operating system of the router and which almost nobody updates. Router firmware vulnerabilities are well documented and are actively exploited, and an unpatched router with a default password is one of the easiest targets on the internet. Checking for a firmware update is a five-minute task that belongs in every network assessment.

The configuration that matters, in order. Change the admin password to something strong and unique. Use WPA2-AES or WPA3 for Wi-Fi encryption — WEP and WPA-TKIP are broken and should never be selected; if a device will only connect with WEP, that device is the problem. Set a strong Wi-Fi passphrase, and change it when someone who had it should no longer have access, which is the part everyone forgets.

Disable WPS, remote administration and UPnP unless there is a specific reason for each. Set up a guest network for visitors, which isolates them from your own devices — this is genuinely valuable in a business where customers, delivery people and contractors all ask for the Wi-Fi. Rename the network to something that does not identify you or your router model, and do not broadcast anything unnecessarily.

For a business, two more things. Separate the networks you can: staff devices, guest access, and any payment or point-of-sale equipment should not share a network with a visitor's phone. And write down the configuration — the admin credentials in a password manager, the Wi-Fi passphrase, what was disabled and why — because the next person to work on it will otherwise guess.

The danger of public Wi-Fi is usually overstated and occasionally understated, so be precise. The real risk is that you are on a network other people control, alongside other people you do not know. Encrypted traffic is largely safe — and almost everything is encrypted now, because HTTPS is universal — so a site using HTTPS protects your data even on a hostile network.

The genuine risks are specific. A fake access point — someone broadcasting a network named after the café or airport, which your device may join automatically, putting a stranger between you and everything. Unencrypted traffic, which still exists in older apps and some protocols, is readable by anyone on the network. Device sharing — if your laptop has file sharing or network discovery enabled, others on the network may reach it. And captive-portal pages that appear before you connect can be imitated to harvest credentials.

The practical rules: turn off automatic joining of open networks; turn on the firewall and disable file and printer sharing before connecting; use a VPN on public Wi-Fi, which encrypts everything to a server you trust and neutralises most of the risk; and never log into anything sensitive — banking especially — on a network you do not control, because a convincing fake access point defeats the URL check you would otherwise rely on.

A firewall controls which connections are allowed, based on rules about direction, port and address. Your operating system has one built in, and your router is effectively one because NAT blocks unsolicited inbound connections by default. Both are worth having and neither is dramatic.

Understand what a firewall does not do, because the misconception is common and costly. It does not protect you from phishing — a firewall happily permits your own outbound connection to a fake banking site. It does not stop malware arriving through something you downloaded or an attachment you opened, because you initiated that connection. And it does not protect against a weak password, a reused credential, or someone you gave the Wi-Fi passphrase to.

This is why the honest summary is that a firewall is necessary and insufficient. The controls that actually prevent most losses are the ones from the earlier sessions: two-factor authentication, unique passwords, backups, and not opening what you did not expect. A client who buys a firewall and does none of those has spent money on the wrong risk, and part of your job is saying so.