802.X with EAP/TLS. Adjust WAP and client signal strength to controlled physical space as much as possible. Limit unauthorized physical access. Classify data into security categories and never use wireless or Internet access on machines handling the more sensitive categories.
Security is an ongoing game.
Assume that all these methods will be broken eventually. Keep evolving!
We were doing a wireless security scan for a client a few weeks ago. Came across a network labeled ‘USDOJ Surveillance Team’.
This is what I’ve built for my Network. Working fine so far.