What is 802.1X? How Does it Work?

We’ve talked with many organizations beyond even our customer base about wired and wireless security. This past year alone, we’ve had conversations with around 3,000 different enterprises on topics related to 802.1X implementation. Here are some trends we’ve noticed in these discussions.

Common Misunderstandings about 802.1X

802.1X is Only for Wireless Networks.

There is a misconception that 802.1X only really benefits wireless networks. After all, if you’re not transmitting credentials over-the-air to connect to a wired network, why would you need additional security?

But 802.1X is just as relevant for wired networks as wireless ones. Relying on credentials for authentication at all can leave you vulnerable because those credentials can be shared or easily stolen.

You need to be certain that the devices plugging into your ethernet are the ones you want there. By configuring 802.1X with your Ethernet ports, any device that plugs in a cable will be prompted for an 802.1X network profile. This allows organizations to leave ethernet cables out for wired network access, without being worried that an attacker might abuse them.

Credentials / MAC Addresses Are Enough to Identify Devices.

We’ve also seen organizations argue that, as long as they only allow managed devices on the network, usernames and passwords are sufficient. This couldn’t be more false for the reasons we outlined above.

Even if your organization doesn’t have a BYOD policy, usernames and passwords aren’t locked to specific devices. Anyone can use them as long as they know what they are. Sure, 802.1X improves your network security, but even a RADIUS server can’t give administrators any real certainty about the people and devices accessing your network if you’re using passwords.

Another common argument is that if you gate network access by MAC address, only allowing specific MAC addresses on the network, then that’s enough. The issue with this is that many devices will report a randomized MAC address every time they connect to a network to prevent tracking a user across different networks. While this supports end-user privacy, it means that administrators can’t rely on MAC address authentication alone.

The solution to this conundrum is digital certificates. Digital certificates, unlike passwords, are issued uniquely to a device’s hardware (TPM / Secure Enclave) and can be configured non-exportable. They cannot be transferred or shared, giving administrators much more certainty over the people on your network. Certificates are also comprised of detailed templates that can provide organizations with much more information about individual users, including their operating system, their MDM, their location, and much more.

Network Security Doesn’t Matter if all Your Resources are in the Cloud.

A common question we get from organizations is: why should I care about network security when all my resources are in the cloud? In other words, why should you secure your local network resources, if all of the important stuff - such as your Identity Infrastructure, applications, and device management systems - are in the cloud?

Network security still matters even in a world that’s increasingly cloud-based. There are a number of attacks that hackers can conduct once they’ve penetrated your network, such as Address Resolution Protocol (ARP) attacks, Spanning Tree Protocol (STP) attacks, and more. Once a malicious actor has gained access to your network, they can also easily harvest credentials where you use them and leverage those for access to sensitive resources.

Your network, put simply, is like a door. It may just be the starting point, but it can lead to a lot of damage if you don’t secure it properly.

Most Popular Reasons for Moving to 802.1X

There are three main reasons our customers report making the switch to 802.1X: increased network security, simplified wireless connectivity, and compliance with regulatory standards.

Increased Network Security

802.1X is a step-up in security from traditional pre-shared key (PSK) networks, which end-users access by entering a single common password. It requires individual users and devices to each have their own set of credentials to log in with, giving network administrators much more control and enhanced visibility over who’s logging in.

However, 802.1X is even more secure when you tie it to digital certificates. Digital certificates are made from templates that contain a plethora of information about the users and devices using them. Whereas a username/password only shows you the username/password being used (since they can be shared), a certificate can show you so much more, including the operating system, MDM (if applicable), role, location, and user email address.

Simplified Wired & Wireless Connectivity

We’ve established above how 802.1X, especially when paired with the iron-clad authentication offered by a PKI, improves network security. What we haven’t touched on yet is that it doesn’t just improve security - it can make connecting to your network even simpler for your end-users. This might seem counterintuitive; generally, when you make things more secure, you require more from your end-users, resulting in a more complicated login process.

But 802.1X can actually make things easier. Separate logins for each individual user and device means that when there’s a password change for any one of them, it only applies to that individual. However, if you’re using PSK - a single password for the entire network - changing the password means disconnecting all devices on that network.

Things get even easier when you add certificate-based authentication to the mix. You no longer have to require specific, complex password requirements for network access. Users can connect just by using their certificates, which can be tied to your MDM or Identity Provider. Furthermore, because certificates can be encoded with information from your Identity Provider, they can be used to apply access policies automatically. For example, you could have users from different departments automatically segmented into their own VLANs when they authenticate to your network.

Meeting Regulatory Requirements

Standards are rising across the board for enterprises in light of the increasing complexity of cyber-attacks. One example is the National Institute of Standards and Technology’s (NIST) requirement 3.5.2, which states that organizations must verify the identities of both users and devices prior to granting them access to systems.

Usernames and passwords alone make this impossible. They can be easily stolen, and even if they’re not, users may sometimes share them with others. Moving to 802.1X (especially with certificates) helps enterprises to meet tightened regulatory guidelines like those provided by NIST.

Recent Changes in 802.1X Perceptions

High-Profile Attacks have Raised Awareness of Network Security.

It seems like every other day, we’re faced with news of another data breach or an organization being targeted by hackers. In just 2024 alone, we’ve seen malicious actors target Ticketmaster’s database and leak sensitive information for around 560 million people. AT&T also suffered an attack that exposed records for 73 million people.

One of the most unquantifiable results of these attacks is the significant loss in reputation the organizations who were breached face. Prospective customers lose trust in organizations who didn’t have the ability to protect their sensitive information from cybercriminals. We noticed this awareness factoring into discussions with our own customers, who don’t want to become another statistic on the news.

Increased network security continues to be the top reason we see customers deploying 802.1X. A big part of this desire for ironclad security comes from enterprises wanting to preserve their customers’ trust by protecting themselves from breaches.

Decreasing Support for Network Policy Server (NPS), Credential Guard Raising Standards

Windows Credential Guard can protect sensitive user credentials on Windows devices through hashes and various hardware security mechanisms. Wider use of Windows Credential Guard, along with a steadily decreasing support for NPS, makes the very common legacy setup of NPS, Active Directory, and PEAP-MSCHAPv2 a bad end-user experience and a significant amount of work to manage day-to-day. In an increasingly cloud-based world where organizations are moving critical infrastructure, such as their identity management, to the cloud, it’s vital that their RADIUS also supports cloud functionality.

For years, one issue we’ve heard from many customers is that they want to move much of their infrastructure to the cloud. If you’re using Azure AD/Entra ID, this means you can’t stick with legacy solutions like NPS anymore for 802.1X - you need a cloud-based RADIUS server such as Cloud RADIUS.

Awareness of Cloud and Managed Alternatives to Traditionally On-Premise Solutions is Growing.

Historically, the components necessary for 802.1X (especially the RADIUS server) were constructed and maintained day-to-day on-premise. While we still speak with many organizations that continue to have physical authentication servers on-site, our discussions show us that there’s a growing awareness of cloud-based alternatives.

Increasingly, administrators and security professionals understand that RADIUS and PKI don’t need to be handled on-premise. In fact, it’s generally easier, less costly, and less time-consuming to look to managed services. We’ve heard recurring sentiment that, the more a security professional knows about PKI, the less they want to handle it themselves regularly. And little wonder - this research by Spectre Ops shows just how expensive managing your own can be.