Best practice

Do not use WEP encryption, EAP-MD5, LEAP authentication - if your firmware does not support stronger encryption/authentication methods, always use an IPSEC/VPN solution

Replace WPA/TKIP with WPA2/CCMP if it is possible

Use WPA-PSK with truly random keys

Use secure EAP (PEAP, EAP-TLS, EAP-TTLS, ..)