PP106: Architecting for Wi-Fi 7, Zero Trust, PQC, and More
At RSA 2026, JJ and partner JD presented on network security trends from 2026-2030, covering Wi-Fi 7's security implications, device identity challenges, zero trust on the LAN, and post-quantum cryptography. The talk argues that enterprises have accumulated 'architectural debt' by iterating on existing configurations rather than rethinking foundational network design. Device identity — specifically moving away from MAC addresses — was identified as the single most critical blocker to implementing modern security architectures.
Summary
This Packet Protector episode is a post-talk debrief recorded live at RSA 2026 in San Francisco. Host Drew Connery-Murray interviews JJ, who co-presented a session titled 'Network Security 2026 to 2030: What Every Fortune 500 Should Know' with JD, a senior network engineer specializing in wireless.
The conversation opens with a diagnosis of the industry's core problem: network engineers have fallen into a pattern of iterating on existing configurations and vendor products rather than rethinking architecture from first principles. JJ frames this not as 'technical debt' but as 'architectural debt' — a distinction she attributes partly to the increasing complexity of vendor-specific products and the time pressure of constant firefighting.
The first major topic is Wi-Fi 7 and its security implications. JJ explains that while organizations have historically treated Wi-Fi upgrades as incremental, the jump to Wi-Fi 7 is qualitatively different. Wi-Fi 7 mandates WPA3 across all bands and introduces new cipher suites — specifically GCMP-256 replacing the 20-year-old AES-128. Critically, Wi-Fi 7 now advertises two cipher suites simultaneously, something that hasn't been done in over two decades and has not been broadly tested for client compatibility. Additionally, even open/unauthenticated networks on Wi-Fi 7 now carry encryption, requiring cryptographic key distribution across access points to support roaming — a new operational complexity. The practical message is that enterprise budgeting and migration planning for Wi-Fi 7 must reflect these deeper changes.
The second major topic is device identity, which JJ describes as a 'linchpin' blocking progress on zero trust, micro-segmentation, SASE, IoT management, and OT integration. The core problem is that MAC addresses — long used as device identifiers in network operations and security — are fundamentally unsuitable: they can be spoofed, are being recycled, and are now being randomized by default across smartphones, laptops, and tablets per IEEE guidance. JJ argues the industry must move to cryptographically significant device identities using certificates. She points to IEEE 802.1AR (device identity standard from ~2007-2009), TPM chips as hardware roots of trust, and the consumer MATTER IoT protocol — which runs on full PKI with certificate authorities — as proof that this is technically achievable. The ACME protocol's device attestation capabilities are also mentioned. The call to action is directed at Fortune 500 buyers to pressure endpoint vendors to support proper certificate-based identity provisioning.
The third topic is zero trust at the LAN edge. JJ distinguishes between software-enforced zero trust (viable in data centers with agents and labels/tags) and the network-enforced segmentation required on the LAN, where there is no equivalent tagging construct for devices. She mentions EVPN/VXLAN as an emerging approach to bring flow-based, identity-tagged policy enforcement to the campus network edge, allowing segmentation policy to follow traffic end-to-end.
The fourth topic is post-quantum cryptography (PQC), which JJ prefers to call 'quantum-resistant cryptography.' She notes that the networking industry's adoption and awareness of PQC sits near the bottom of the technology stack — just above OT — and that this gap needs to be addressed urgently.
JJ also mentions that slides and supporting resources — including a wireless security best practices guide, an Air Snitch Wi-Fi vulnerability briefing, and a zero trust maturity model mapping — are available for free download through the RSA conference agenda page, released by IONS.
About this episode
For decades, network and security professionals have adapted to technology change in a piecemeal fashion: a new rule here, an upgrade there, a new product deployment over yonder. On today’s Packet Protector, co-host Jennifer ‘JJ’ Jabbusch makes the case for why several emerging technologies require IT pros to think about security at an architectural level.<a class="excerpt-read-more" href="https://packetpushers.net/podcasts/packet-protector/pp106-architecting-for-wi-fi-7-zero-trust-pqc-and-more/" title="ReadPP106: Architecting for Wi-Fi 7, Zero Trust, PQC, and More">... Read more »</a>
Key Insights
- JJ argues the industry suffers from 'architectural debt' rather than merely technical debt — engineers keep iterating on vendor-specific configurations instead of rethinking foundational architecture, partly because product complexity has grown so high that basic connectivity requires weeks of vendor-specific training.
- JJ claims Wi-Fi 7 introduces a qualitatively different migration challenge compared to previous generations because it simultaneously mandates WPA3 everywhere, introduces GCMP-256 cipher suites replacing 20-year-old AES-128, and advertises two cipher suites concurrently — a configuration that has not been widely tested for client compatibility.
- JJ identifies device identity — specifically the inability to use MAC addresses as reliable identifiers due to spoofing, recycling, and widespread MAC randomization — as the single most critical blocker preventing enterprises from implementing zero trust, micro-segmentation, SASE, and effective IoT/OT management.
- JJ points to the consumer MATTER IoT protocol as evidence that full PKI with certificate authorities is feasible even for small, resource-constrained devices, arguing this undermines vendor excuses for not supporting cryptographic device identity in enterprise wireless NICs and endpoints.
- JJ states that the networking industry's awareness and adoption of post-quantum (quantum-resistant) cryptography ranks near the bottom of the broader technology stack — just above OT — representing a significant and underappreciated risk exposure for enterprise networks.
Topics
Transcript
Today's Packet Protector episode is sponsored by Meter, the company building networks from the ground up. Meter delivers a complete networking stack, wired, wireless, and cellular in one solution. With Meter, you get fast, secure, and scalable connectivity without the burden of managing multiple providers or tools. Meter scales from branch offices, warehouses, and large campuses to data centers, and its integrated network stack is designed to give you deep control and visibility. Meter covers everything from first-site survey to ongoing support, giving you a single partner for all your connectivity needs. Thanks to Meter for sponsoring. Go to meter.com slash packetprotector to book a demo now. That's M-E-T-E-R dot com slash packetprotector to book a demo. Hey everybody, welcome…
Full transcript available for MurmurCast members
Sign Up to AccessMore from The Everything Feed - All Packet Pushers Pods
TNO071: The Network Team Is Drowning. Is AI the Life Raft? (Sponsored)
Rekha Shenoy and Irfan Kimji from Backbox discuss how the exponential growth of vulnerabilities (49,000 CVEs annually) has made manual network operations unsustainable, and how AI-powered automation can help network teams manage patches and security updates at scale while maintaining human control and oversight.
HN840: How to Make a Technology Buying Decision
Sean Morgan, a research director at Deloro Group, discusses how technology buying decisions should extend beyond engineering specifications to include business alignment, ROI calculations, and understanding total cost of ownership. Engineers must shift from viewing IT as a cost center to positioning it as a business enabler by connecting technical decisions to revenue impact and organizational objectives.
IPB207: Flying Blind: Monitoring Might Not See IPv6
The IPv6 Buzz hosts discuss critical gaps in IPv6 monitoring across enterprise networks, highlighting that many monitoring platforms lack IPv6 awareness, vendor parity, and advanced analytical capabilities. They emphasize that while basic IPv6 data ingestion has improved, sophisticated features like cross-protocol event correlation, extension header analysis, and device identity tracking remain significant industry challenges.
N4N063: Link Layer Discovery Protocol
Link Layer Discovery Protocol (LLDP) is a standardized Layer 2 protocol that enables network devices to announce information about themselves to directly connected neighbors, facilitating network topology discovery and device identification in multi-vendor environments. The protocol uses Ethernet frames with special multicast destination MAC addresses to ensure frames don't propagate beyond immediate neighbors, and includes mandatory TLVs (Type-Length-Values) like chassis ID, port ID, and TTL alongside optional ones for extended information.
TCG083: Superintelligence for Everyone: Who Actually Holds the Power?
Three technology experts discuss Mark Zuckerberg's manifesto on distributed superintelligence, examining whether his promises of universal access and individual empowerment align with infrastructure realities. They conclude that while decentralized AI is theoretically safer than centralized control, the manifesto fails to account for human complexity, existing inequalities, and the enormous capital requirements that will likely concentrate power rather than distribute it.