The best practices I've read lately involve getting rid of Mac address
lockdown (which is spoofable) and instead relying on PPPOE, using RSA
SecurID fobs, or using a free pppoe client + strong password encryption.
Requiring individual user identification rather than knowledge of the
key (which is crackable with widely known software) or mac addres (which
is easy to spoof if you do a little sniffing in promiscuous mode) should
get you further.
I read a white paper on this somewhere with regards to setting up a
wireless freenet in a rural part of America, where the chief concern was
theft of service that would limit the ability of the operators to
control bandwidth utilization.
DB
We are moving into larger offices later this month. The buildings we are
moving out and and into are both regional development buildings so house
multiple companies, hence we hide the AP, limit MACs, require a strong
key which will change every month or so and have it on a NIC that's
firewalled. Not much else we can think of on a practical level... Unless
you guys can.