I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students;
It used to use EAP, allowing students to enter their academic credentials once in their native Wi-Fi client. Now the network is open, with a redirect to a secure browser page that authenticates credentials.
I am meeting with the vice chancellor of my college in two weeks and want to make sure my case to encrypt the student network again is solid. Trying to explain the difference between authentication and encryption to somebody with no technical knowledge is enough of a pain;
beyond explaining that the network is, in fact, open, I have to convince them that an open network is a significant risk, especially given the high volume and low technical literacy of the student body (it's a large community college).
Finally, the IT admins have claimed that the basis for switching was device compatibility -- that they could no longer support all student devices on the network.
Given that the staff still has an encrypted network, and likely uses the same variety of devices as the students, I suspect this is an excuse. Certainly on the front end EAP is a pretty well established standards. I have no clue what things look like on the back end, though.
EDIT: I have no "threat model", and I am not asking about some idealized form of security. Please understand the context of my question and answer in a manner relevant to that context. I need an reasonably actionable IT policy to advocate for, and I need to be able to present some concept of risk vs cost to the Vice Chancellor.
Is there any merit to what IT has been claiming? And am I right to be agitating for encryption for the student body?