First, let me premise this post with the fact that I am completely new to network security. I have done a fair bit of reading up, but I am certainly by no means a professional. If anything I say here is wrong or stupid, please, please, correct me.
Anyway, largely because I have enough patience to install a printer driver, and have a VPN set up on my personal computer, I have been selected to set up all of the IT systems at my workplace... We are currently operating in a shared office space. The fact that the password for the wifi provided by the office space is one of the top 5 most-used passwords in 'l33t' format has me greatly worried about the security posture of the office space as a whole, and therefore my company's NETSEC with it. I understand that the high turnover rate in this office space drives the need for a simple password, but to me it is precisely that same high turnover that needs to be taken into account when devising a network security strategy.
So, question 1) Am I right in being worried that this is incredibly insecure? Wouldn't it take 1/10 of a second to get the network password, and then open up a whole host of vectors for attack? I feel as though packet sniffing, and ARP spoofing should be relatively easy to accomplish, even by someone who has little to no experience such as myself.
Some more context to work with: we do not currently have the need for a dedicated server, and probably won't need to for the next two years or so. Due to the size of the company at the moment, and plans for growth, this has been deemed an unnecessary cost. Basically until then, I am hoping to implement a few simple security measures. I would like to install third-party firmware onto a wifi router which would be plugged into the office space's network. I would then use that router to connect to a commercial VPN provider. Our office computers would connect to that router alone.
Question 2) Is this a realistic answer to the insecurity of the office space's wifi network? Am I wrong in believing that this would protect our data from being visible to running something like Wireshark on the LAN?
From my understanding of it, and if I were to do this, we would lose access to the firewall that the office space currently has on their network (I'm not even certain they have one, but that is a gripe for another discussion). Therefore, I would have to ensure that the VPN traffic is protected in that regard. To address this, I want to install a business antivirus software on our IT systems (with an admin console and all that jazz) that has a firewall integrated with it.
Question 3) Bearing in mind the answers to questions 1 and 2, is implementing such a host-based firewall solution from one of these antivirus softwares an intelligent manner of dealing with this problem?
As I mentioned, the size of our company precludes it from having a dedicated server through which activity could be monitored by someone more competent than me. I think we will have to rely on the AV and its firewall, as well as a lot of education on what phishing attempts look like, why we would be implementing these measures, etc.
Question 4) I know this is vague, but what am I forgetting? If you read my long-winded post, you have about as much information as I do - so what else would you do if you were me? Or would you do approach this problem from a totally different angle?
Thank you for your help! And sorry for the novel...