Shared Office Network Security

[benny.c]

My wife has just started renting a small office in a building which contains approx ten other offices, all occupied by individual small businesses. There is a communal WiFi network which she is currently using but given the network name and password is posted in a public part of the building, it’s going to be no more secure than using the net in Starbucks etc. Even if this wasn’t visible she is still sharing a network with many people she doesn’t know.

What are her options for making her internet access more secure? I’ve read it’s reasonably simple to set up a wireless network just for her (and one other employee) using a router which accesses the public network but then broadcasts an SSID that only they would have the name and password for? This would also be useful as she’d then have a wired connection for a few devices which she currently can’t use - the office has no wired network points.

She’ll probably get in touch with a local IT place but I was hoping to get a few pointers before she speaks with them. Cheers.

[Mattt]

What devices does she have in her office?

Does she need any form of local network?

[benny.c]

There’s two people in the office - Two MacBooks, two mobiles, a printer and a Vonage VOIP phone (that needs a wired connection). I think a local network would be handy so they can file share as some of the media files are quite large. They’re using Dropbox for this at the moment I believe.

I assume a local network would also be required for the printer?

Edited by benny.c on Tuesday 16th March 23:22

[megaphone]

I'm surprised the office services supplier does not offer a hard wired ethernet connection.

Minimum I would do is set-up a router with a good firewall, then put all your devices onto your own Wifi SSID and wired network. Obviously you would need to connect to the 'free' wifi for internet, you could do this with a separate WiFi access point that can be set as a station/client mode. (check if it is 2.4 & 5Ghz).

One issue will be double NAT as you will effectively have two routers in service (the free wifi router and your own)

If long term, can she get her own BB?

Could you use 4G?

What do the other businesses in the building do?

Edited by megaphone on Wednesday 17th March 09:48

[Mr Pointy]

Can't she use her own 4G modem & ignore the supplied Wifi? What's her monthly upload & download useage?

[nebpor]

EE 5G unlimited SIM is 33/month - I use one for home broadband. It's properly unlimited, albeit there will be a fair use provision that I doubt you would ever hit ... I certainly haven't, on a heavily-used home connected where two are WFH as well as kids streaming all the time.

it's probably one of the simplest/cheapest/quickest ways of getting started. Just need a 4G router for roughly 120 off Amazon

[eeLee]

I would create my own network unless the coworking space allocates VLANs to its tenants.

The good thing is that the wifi connection might have client isolation implemented. But this will break the printer (I assume it has wifi). If this is not enabled then the clients will be able to see each other and would be able to use the printer.

I would take the double-NAT route which will probably break nothing but would need a wired connection to the shared network. Everything behind that router would be protected from the network. This is what I do to isolate my networks from my CPE (modem/router from my ISP).

[Mr Pointy]

Three are currently offering either a 4G or a 5G hub with unlimited data for £24 or £17 a month (just watch the contract length). I think they both have a network port so you could connect this to a cheap switch & have a wired & wireless system:

http://www.three.co.uk/store/broadband/home-broadb...

i'm not sure aboutthe VOIP requirement though.

[Insert Coin]

As above 4g, I use a Vodafone 4g sim, all you can eat, full speed for £35 all in.

[Mr E]

This is what VPN exists for.
Tunnel important traffic to somewhere you trust.

Setting up a second SSID that backhaul over the location WiFI won’t help. I’ll just pull the traffic off the ‘public WiFi’

[eeLee]

I don't dispute that a VPN may help here but the OP has a need for access to LAN resources (I assume the printer is not going to be cable-connected). The question also would be what would a VPN connect to - if the OP's wife works for a corporate then there will be a VPN in play, if she is self-employed then her tooling exists over a TLS connection and the VPN is pointless (assuming she trusts her DNS which, with her own router, she could configure).

Traffic passing over the shared network should largely be no problem (seeing that around 80+% of the Internet is on HTTPS).

[Mr Pointy]

eeLee said:

Traffic passing over the shared network should largely be no problem (seeing that around 80+% of the Internet is on HTTPS).

Although oddly enough that Three page I linked doesn't seem to be. It stands out when Firefox & NoScript flash red at you.

[benny.c]

Thanks all. A 4g router may be the simplest solution here but we'll just need to check what speeds are achievable. She's only just moved from the home office where we have reasonable internet speeds so we've never checked her usage. She works in digital marketing, SEO etc so basically spends the whole day on the net. She runs her own company so no corporate issues to consider.

A physical connection to the printer isn't a deal breaker but it's convenient as they can print straight from their phones, tablets etc.

Maybe I'm over worrying it but the main concern is malware and what is potentially visible by anyone else who can access the network. She has client's login details, passwords etc to consider.

(Australiam, thanks the the pm, I've sent you a reply).

[deckster]

benny.c said:

Maybe I'm over worrying it but the main concern is malware and what is potentially visible by anyone else who can access the network. She has client's login details, passwords etc to consider.

Malware is simple to avoid - don't click on dodgy links.

And as above, assuming that details are sent over HTTPS then you don't need to worry about login details being leaked.

Honestly I'd not worry too much about using a semi-public network like this. Just make sure that Windows has it flagged as public rather than private and by default it locks things down pretty well. Adopt secure practices on your own equipment and you won't have a problem.

[eeLee]

I see no advantages with an LTE/5g modem over a router sitting on some shared network that creates a private network behind it.

At some point, you have to trust what is between you and the resource you access on the Internet. Do you really think someone is sat on this network running wireshark or something?

[Mr E]

It occurs to me that if I was of a nefarious intent, renting office space where a bunch of freelancers will be on the same network and potentially have data/credentials for multiple clients could be a rewarding thing to do.

[eeLee]

Mr E said:

It occurs to me that if I was of a nefarious intent, renting office space where a bunch of freelancers will be on the same network and potentially have data/credentials for multiple clients could be a rewarding thing to do.

In 2009 maybe, when you had this to deal with: https://en.wikipedia.org/wiki/Firesheep

In 2021 with ACME certificates and a massive lean to HTTPS, really the risk is diminishing of clear text being massively available on a network. Your signal to noise ratio today is tiny and if you targetted someone in this environment to exploit, it would not be using network sniffing.

We still don't know if the wifi they have has client isolation turned on; that would make it even harder to sniff.

[Mr E]

eeLee said:

Your signal to noise ratio today is tiny and if you targetted someone in this environment to exploit, it would not be using network sniffing.

No, I’d be looking to compromise the machines on the same network for data. I strongly suspect a lot of one man bands are a bit lax on IT security

Although, probably just as easy to sit in the kitchen and ask questions or look for unlocked machines when people pop out for lunch.

[eeLee]

Mr E said:

No, I’d be looking to compromise the machines on the same network for data. I strongly suspect a lot of one man bands are a bit lax on IT security

Although, probably just as easy to sit in the kitchen and ask questions or look for unlocked machines when people pop out for lunch.

I don't think modern machines will be as easy to do this as older ones. You either need a lax by-default security config or a wormable flaw.

If you deliberately gain close proximity access to a target then I would assume you have a specific target you want to exploit. Impact could be high, potentially, likelihood is low.

But you're right, anyone on this network should patch and treat the network as public which is why I would either wire a router to it or use a router than can access it via wifi and allocate its own class D network behind NAT/firewall.

[Road2Ruin]

You can have a network without it being connected to the Internet. The safest and simplest way of securing files. Just get a cheap router turn off WiFi on it, connect both computers and NAS, if you have one, to it. Then set up files sharing etc.

Then just use the public WiFi for the Internet.