Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
From a security perspective, is it considered bad practice to use the company name as a part of an SSID?
Assuming that the company is located in a densely populated area with a lot of "competing" wireless networks, having an easily identifiable SSID would make it easy to find the network for those who work at that office. However, it would be equally easy for others outside the office to find the network.
Would I be overthinking this if I required wireless network SSID's to be random strings?
"Hiding" your SSID is just "security by obscurity" - like hiding the front door key under the mat. It works only as long as no one figures it out. Once it is figured out, it provides zero security.
In general, you want security measures that will work even if everyone knows what measure you've used.
Yes, by providing your name, any opportunist can focus on your network if they have that desire, but just having a WiFi network broadcasts that a network is there, anyway. If someone is targeting you specifically, they will find your SSID, even if you obscure or hide it.
So, hiding or obscuring the SSID provides very, very low protection. Unless you have a specific reason to need such specific, low, and opportunistic protection (and there are possible reasons), I'd focus on securing the network instead.
As JPhi1618 and emory point out in the comments, you could even create a security issue by using a nondescript SSID: If you set it to df42Sdd235f2, for example, then someone could set up a WiFi network with your company name or even df42Sdd235f3 in order to attract people to connect to it instead of your corporate network and the victims would not have any clues that the network was not the official network.
It doesn't help for reasons described in other answers. And there is actually a way for an attacker to use strange SSIDs against you. If your access point authenticates itself with a certificate and its SSID is "Company", then no attacker can claim to be "Company". They would need to choose another SSID, so there would obviously be two networks and this would hopefully make employees think about which one is right (and notify/ask someone who would be able to tell that this is an attack).
If the official network is "iewrbfpwh" and an attacker creates a network "Company" you can be sure some people would connect to it by mistake.
From a security perspective, is it considered bad practice to use the company name as a part of an SSID?
No.
Would I be overthinking this if I required wireless network SSID's to be random strings?
Yes.
While doing this may prevent the simply curious, this will in no means deter an interested or determined attacker. Effective security should always put more burden on the attacker than the resource being protected. So let's examine this a bit.
Even if you are in a large multiple story building in the center of a large metropolitan business district (probably the extreme example of "located in a densely populated area with a lot of 'competing' wireless networks"), it would take no more than knowing you were there, a moderate amount of access (for example stairwells typically are easy to access for escape purpose and will suffice for the purpose), a laptop running Linux (or other OS with specific tools available), and 10-20 minutes to figure out which wireless network(s) were yours. Having some other 802.11 tools available and/or more access, it could be done easily in less than 10 minutes.
If you have a guest network that is easily recognizable by visitors, it's possible to determine your networks in less than a minute.
Now, compare that to the burden put on your users and IT staff. How confusing this would be to them, how many mistakes were made, how many times the questions are asked, etc. Depending on the size of your organization, this would be well over 10-20 minutes per day and would certainly be much more when you first establish this policy (each device would have to be "touched" in some fashion, etc).
This fails the test of effective security and enters the realm of security theater. There is really no security benefit to this type of action.
I would not broadcast an obvious SSID name. While I do not believe in security by obscurity, I don't see a strong incentive in advertising your identity over the airwaves. And the SSID doesn't have to be random characters, it can be somewhat memorable but unrelated to the actual company name.
I'd rather brief the people who work in your office and grant them access on a need to know basis, because you'll have to provide them with the password anyway, right ? And it's usually configured once on their device, unless you have some additional setup we don't know of. So I don't see much of an inconvenience here.
That being said, I think it depends on the purpose. I might broadcast the company name on a guest network for visitors, that grants access to the Internet and nothing else. In this case, you want to make it easy for outsiders to find the wifi network.
If the wifi hotspot is connected straight to your LAN then I would rather keep a lower profile. I might even hide the SSID if it is practical to do so. Although we all agree that does not provide protection but frustrates reconnaissance efforts.
One thing to bear in mind is that some devices broadcast which SSIDs they have previously connected to when they're out and about. This may make it trivial to identify employees/visitors to your company away from the site itself.
It will depend on your threat model as to whether this is a concern, though.
... is it [a] bad practice to use the company name as a part of an SSID?
As schroeder mentions above, probably not.
However, it feels like you are setting a bad example, right?
Just pick something and consistently use that - everyone will still know what to pick off the list, and you don't look "unsecure" to people who aren't informed.
Anecdote:
A friend who works for X (a fortune 200 networking company) was at my house a couple years ago with his work laptop. "Oh! Blizzard."
Me: "Huh?"
"I just got into my company's internal network. Blizzard is the network id my company uses, but I didn't realize they used it everywhere."
Me: "Ah, that SSID. Neighbor works for X."
Not broadcasting any SSID, combined with MAC filtering, might be the only approach which adds to security - because this requires an additional factor for the authentication and it would only permit known devices. The down-side is, that it also adds administrative effort for adding/removing MAC addresses and supporting users with setting up eventual BYOD.
