The problem isn’t the password
The usual setup is a single wireless network with the password on a chalkboard, or, slightly better, a second network name with a different password. Both feel like separation. Neither is.
A second network name only separates who can join. Once joined, in most default configurations, a guest device is on the same network as everything else: the point-of-sale terminal, the office computers, the network printer with the scan-to-folder share, the camera recorder, and the file server. Anything one device on that network can reach, every device can reach.
That isn’t a theoretical concern. It’s the reason a compromised phone in your waiting room is a problem, and it’s why network segmentation is the first thing we look at in any retail, hospitality, or medical business.
What can go wrong
Card data exposure
If you take card payments, a guest network that can reach the point-of-sale is a PCI DSS problem, not just a security one. Segmentation is the difference between a small scope and a scope that covers your whole network, which changes what you’ve to prove and what an incident costs you.
Lateral movement from an infected device
You have no control over the phones and laptops that join your guest network. One of them will eventually be compromised. On a flat network that device can scan for and reach everything else, which is exactly how ransomware spreads once it gets a foothold.
Printers and cameras as a way in
Network printers and camera recorders are the least-patched devices in most buildings, and many ship with default credentials and a web interface. They’re a soft target and they usually sit on the same network as everything valuable.
Bandwidth you’re paying for
The least serious problem and the most noticed one. Without limits, a handful of guests streaming video will make your own systems feel broken, and the fault will be blamed on your internet provider.
How to do it properly
Put guests on their own VLAN
A separate network at the network level, not just a separate name. On business equipment such as Ubiquiti UniFi, this is a configuration option rather than extra hardware, but it does need equipment that supports VLANs. Most consumer routers do not, in any meaningful way.
Block guest-to-guest and guest-to-internal traffic
Client isolation stops guests reaching each other, which protects them. A firewall rule blocking the guest VLAN from reaching any internal network is what protects you. Both are needed, and the second one is the one usually missing.
Allow only what guests need
That’s internet access and DNS. Not access to the printer, not access to shared folders, not access to the cameras. Start from deny and add what is required, which is almost nothing.
Rate-limit the guest network
Cap it well below your total bandwidth so guests can’t starve your business systems. It also makes the network less attractive to somebody sitting in the parking lot.
Rotate the password, or use a portal
A password that has been on the same chalkboard for four years is public. Either rotate it on a schedule, or use a captive portal with a daily code or a simple terms-of-use click, which also gives you a place to put your own branding.
Separate the other things too, while you’re in there
The same reasoning applies to cameras, point-of-sale, and building systems. Each belongs on its own segment. If you’re paying for the work of segmenting once, segment properly.
What this costs
If you already have business-grade wireless equipment, this is usually a configuration change measured in hours rather than a purchase. If you are running a consumer router from an electronics shop, it’s the point at which that router has to be replaced, and it was going to need replacing anyway, because a device designed for a house doesn’t behave well with twenty devices and two networks on it.
For a typical small office or shop, expect a survey, a modest amount of equipment, and a day of configuration. It is one of the cheapest meaningful security improvements available to a small business, and unlike most of them it also fixes a performance complaint people already have.