I know that there is a vulnerability with WPS, even when using WPA2, but aside from that is WPA2-PSK really secure?
Define secure. In the general sense, if you have WPS disabled, are using a long PSK and avoid default SSIDs, you should be okay. Unless you have a reason to have your network targeted by an entity with resources to brute force your network, you will likely be more than safe enough.
There are a few things on the horizon that have promise for some increased security options. First, the Wi-Fi Alliance proposed WPA3 as a certification track to improve on WPA2. While WPA3 is not standards based (i.e. it is not based on an amendment to IEEE 802.11) and has several flaws, it shows there is interest in improving wireless security before WPA2 becomes irrelevant. I expect it to join WPA in the history books when replaced by a relevant standard, but just like WPA take it for what it is...namely a non-standard attempt to improve on the previous wireless security standard.
Second, top enterprise wireless solutions are already shipping with the capability to define PSKs per device. This is not standardized and different vendors do it differently at present, but this means that cracking a PSK is less damaging and exploitation may be more noticeable (if a PSK is tied to a MAC address, cloning the MAC is possible, but will often result in connection problems for both devices attempting to use the MAC). When many vendors (who are heavily invested/involved in IEEE and WFA) tend to find value in a feature like this, it often becomes standardized and implementation can start trickling down to consumer devices.
Third, the simple fact that there is more discussion about WPA2 and if it is secure, by users and media alike. While the IEEE currently doesn't have an 802.11 working group tasked with a security amendment, I would not be surprised if one is started in the next year or two.
how home users can secure their networks?
- Disable WPS. Number one security vulnerability on home wireless networks is WPS.
- Keep device drivers and firmware up to date. This applies to both the AP/gateway device and to all wireless clients.
- Use a long PSK. 20+ characters is often considered enough, but most devices will accept a PSK up to 63 characters in length.
- Choose your SSID name with some thought.
- You want to avoid using something too common as it is used along with your PSK to generate your encryption. Common SSIDs can have pregenerated hash tables to compare against.
- You want to avoid using an SSID that is too uncommon. If your SSID is too unusual, it can potentially be used as a means of locating your home. There are a number of publicly available online databases that contain information (often including coordinates) that can be queried.