With all the recent WIFI hacks, how we should configure our organizational Wifi security configs and version?
You may need to be a bit more explicit with your concerns. You mention KRACK; I posted this answer about the impact of KRACK. Over a year since that post and there are still no reports of this exploit in the wild. KRACK is in most practical terms a non-concern at this point. Could this change? Sure, but not likely.
Only other recent "WIFI hack" I am aware of is the hashcat attack on PMKIDs on wireless networks using PSK. Mitigations here are to either use longer, more complex PSKs or switch to 802.1X.
While it isn't a hack, WPA3 has been mentioned in a number of media channels and is the source of a number of these discussions I have had in the past months, so let me point to another of my answers that talks about WPA3. The majority of that answer still holds true despite some minor changes from the WFA (for instance, I believe OWE is now optional as well).
How we can set our organizational enterprise WiFi to be secure, if there no best practices to follow?
All the major enterprise wireless vendors maintain their own best practice document(s) that contains security and design recommendations. Here are some examples: Cisco, Aruba, and Ruckus.
While many of the recommendations in vendor best practice documents are specific to their platform, the principles often can still be applied. But some general guidance I would give to any deployment I am involved in would be the following:
- Use 802.1X over PSK. Depending on your security requirements, pick the first option from below EAP methods:
- EAP-PEAP or EAP-TTLS with proper client/supplicant configuration and two factor authentication generally considered most secure.
- EAP-TLS if you can't use the above with TFA.
- EAP-PEAP or EAP-TTLS with proper client/supplicant configuration - generally sufficient for non-mobile devices and doesn't involve the additional complexities of client certificates used by EAP-TLS.
- If you must use PSK, make it long and complex (but length trumps complex if you must choose between the two).
- Disable fast roaming/transition/PMK caching features on infrastructure if not necessary. This will slow down client connections and increase load on RADIUS servers.
- Disable the use of WEP or TKIP (often tied to WPA) - not only necessary from security perspective, but from performance perspective as well (802.11n or newer networks disable data rates higher than 54Mbps if either is in use).
- Enable mandatory 802.11w (protected management frames) if your clients support it.
- Require use of DHCP by clients if possible.
- Enable client isolation features if available and your wireless clients do not need access to other wireless clients.
- Enable rogue detection features to notify when networks are found using the same SSID(s) as your network.
- Keep your clients and infrastructure patched.