s networks in most cases. WPA should only be used on legacy hardware that is not capable of supporting AES-CCMP. WPA can be installed in two flavors, called personal, which uses preshared keys (PSK) for local authentication, and enterprise, which uses 802. 1x and an external authentication server such as RADIUS. You may see WPA2-Personal referred to as WPA2-PSK, WPA2-Enterperise referred to as WPA2-dot11x, and any number of other variations that should be pretty easy to understand. So what should you use? Again, read up on the many forms of wireless security, design, and implementation found in books far more detailed than this one. For home use, WEP may be fine, but only if you have dogs and mimes trained in network security. For most small to medium-size implementations, WPA2-PSK is the best choice for balancing security and simplicity. For larger enterprises, complex WLANs employing wireless LAN controllers are the norm. If you want to be painfully secure, allow your wireless network to have access to nothing but an authentication server and VPN device. Force two-factor authentication to the wireless network, and then force VPN with two-factor authentication to gain access to the network proper. This way, even if someone could gain access to the wireless net- work, she won't be able to see anything, since there are no resources available and all other transmissions are encoded with strong encryption. Chances are, no one will use the wireless because it's SO complicated, but hey, security is a balance between Security convenience and paranoia. And yes, I worked at a site that required VPN over the WPA2-Enterprise wireless LAN. Perhaps more important than the authentication methods used is the underlying net- work architecture built to support the wireless network. Guest VLANs, wireless VoIP VLANs, wireless LAN controllers, and the like are important facets of wireless net- working that can have great impact on your security. Again, I recommend further reading in books dedicated to the topic, since I won't be go