Office guest network is open, no password — can customers see everything? How risky is the network traffic?

open wifi = risky obviously. everyone can see the network and do arp spoofing... at least put a password, WPA2 is a billion times better.. but and splitting the network setup is a bit complex but can be done, tp-link routers are variable speed...

If network segmentation is to be done: 1) VLAN configuration on Access Point (VLAN 1 = Guest, VLAN 2 = Corporate), 2) Inter-VLAN routing rules on Router/Switch, 3) Access Control List (ACL) rules: Guest → Corporate ports blocked. 4) Managed AP (meraki, ubiquiti etc.), unmanaged APs don't support VLAN. 5) RADIUS authentication with guest portal (Captive Portal). DNS, NTP traffic should even be separate or blocked. IDS (Suricata, Snort) can be used for sniffing detection but it's overkill for a small office.

don't do open wifi bro, put a password at least. the splitting thing is technical but it might be confusing for beginners — hire a netwwork admin it won't be done in 2 weeks. but if nothing has happened so far, putting a password quickly is very good. then when the admin starts, you do the network setup...

Guest network segmentation best practices: 1) Separate SSID (ssid-guest), 2) Strong WPA2 Pre-shared Key, 3) VLAN isolation (no access from guest to corporate resources) 4) Web content filtering + DNS over HTTPS, 5) Rate limiting per client, 6) Portal page for terms and conditions, 7) Session timeout (8 hours) 8) Connection logs. Managed APs required (UniFi Meraki, Arista Instant On). Setup is tough at first but secure in the long run.

Are customers carrying company data on open wifi? Then that's their problem. But you can still protect yourself: encrypt the guest network, enable VPN at least make HTTP traffic HTTPS. Did you check if customers have antivirus installed on their computers? They're a risk too...

I've been in the IT sector for years, open wifi has zero security. An attacker on the same network (MITM, ARP spoofing, etc.) can see all unencrypted traffic. Industry standard: WPA2 enterprise + 802.1X authentication. But for SMEs, WPA2 personal + network segmentation is enough. Guest and corporate networks must be strictly separate.

I agree and Id like to emphasize that... I mean if its your first time, start small; scaling comes later.

Hope this helps.

You're right. When we decide without measuring, we always end up in the same place.

Let me speak from the other side; I'm on the supplier side. Forgotten test environments are more often the entry point than live systems.

Security isn't absolute; it's about making attacks not worth the effort.

This is exactly what we experienced. When you try to change everything at once, nothing settles.

If I were you, I'd go this route.

Just a heads-up... btw your time to detect an issue directly determines its cost.

Any unwritten clause becomes a point of disagreement later as both sides remember it differently. btw im also curious if anyone does it differently.

I'm curious too.

Great work. The harder it is to reverse a decision, the slower you should make it.

Good luck with that.

I felt relieved reading this answer, so it's not just me. An untested backup is not a backup.

I'm writing this so you don't make the same mistake. like when you try to change everything at once nothing settles.

Exactly like that. Most incidents start with a leaked password not a vulnerability.

If I were you, I'd go this route.

Youre right.

I've been dealing with this for a long time. If you scold false alarms, nobody will report again.

People defend habits, not processes. Resistance comes from there. Of course, it varies if your situation is different.