A cybersecurity analyst at a healthcare organization was tasked with analyzing the indicators of compromise (IOCs) to identify potential threats and…

The indicator of compromise (IOC)—unknown users logging onto the wireless local-area network (WLAN)—directly points to a failure in access control for the wireless network. An unsecured wireless access point is a significant vulnerability that facilitates such unauthorized access. This vulnerability can manifest as a lack of encryption, the use of weak or deprecated encryption protocols (e.g., WEP), default administrative credentials, or easily guessable pre-shared keys (PSKs). Any of these insecure configurations would allow an unauthorized user to connect to the network, matching the observed IOC precisely. The presence of unknown users is a classic symptom of an improperly secured wireless perimeter.

B. Up-to-date anti-malware software is a security control and a strength, not a vulnerability that would allow unauthorized network access.

C. A strong password policy is a security measure designed to prevent unauthorized access, making it the opposite of a vulnerability.

D. Regular security awareness training for employees is a proactive administrative control, not a technical vulnerability permitting unauthorized connections.

1. National Institute of Standards and Technology (NIST). (2012). Guidelines for Securing Wireless Local Area Networks (WLANs) (NIST Special Publication 800-153).

Section 3.1, "WLAN Threats," states: "Unauthorized access is a major security concern for WLANs... An attacker can gain unauthorized access to the WLAN by connecting to an AP [Access Point]... Attackers can also gain unauthorized access to the WLAN through APs that have been intentionally or unintentionally configured to not require authentication." This directly links the IOC (unauthorized users) to the vulnerability (unsecured access points).

2. Rivest, R. L., & Zissman, M. (2017). 6.857 Computer and Network Security, Fall 2017. (Massachusetts Institute of Technology: MIT OpenCourseWare).

Lecture 15: Wireless Security, discusses the vulnerabilities of early wireless security protocols like WEP, which are easily broken. An access point using such a protocol is considered unsecured and would allow an attacker to gain access, aligning with the scenario. The lecture details how weak cryptographic protections fail to prevent unauthorized connections.

3. National Institute of Standards and Technology (NIST). (2008). Guide to Securing Legacy IEEE 802.11 Wireless Networks (NIST Special Publication 800-48 Rev. 1).

Section 3.2, "Vulnerabilities," explicitly lists "Unauthorized access to the wireless network" as a key vulnerability. It details how misconfigured or poorly secured access points provide an entry point for attackers to connect to an organization's internal network.