You have just set up a wireless network for customers at a coffee shop. Which of the following are good security measures to implement? Each correct answer represents a complete solution. Choose two.

The strongest safeguard for an openly-accessible WLAN is to require modern link-layer encryption; WPA/WPA2—unlike WEP—implements 802.11i’s TKIP/CCMP protections and is specifically recommended by NIST for all public-access hotspots. In addition, limiting association to a list of approved MAC addresses, while bypassable by spoofing, still provides a second gate that blocks casual or automated drive-by connections and is cited by NIST as a supplemental control. Together, WPA and MAC filtering constitute two defensible security measures for a coffee-shop wireless network.

B. Not broadcasting the SSID offers almost no real security; the SSID still appears in probe-response and association frames and is trivially discovered with any 802.11 sniffer.
C. WEP uses RC4 with weak IV reuse and can be broken in minutes; NIST and IEEE both deprecate its use for any production WLAN.

1. NIST SP 800-153 “Guidelines for Securing Wireless LANs,” §3.2.2, pp. 14-15: “Organizations SHOULD use WPA2 or WPA… WEP is strongly discouraged.”

2. NIST SP 800-97 “Establishing Secure Enterprise WLAN Solutions,” §5.2, p. 5-7: “MAC address filtering can provide an additional layer of defense, although it is easily defeated.”

3. IEEE Std 802.11-2016, Clause 4.3.3 & Clause 12.4: defines WPA/WPA2 (RSN) protections; Annex C notes inherent weakness of WEP.

4. D. Johnston & J. Walker, “Overview of IEEE 802.11 Security,” IEEE Security & Privacy, vol. 3, no. 1, pp. 38-43, 2005. DOI:10.1109/MSP.2005.11

5. A. Stubblefield, J. Ioannidis, A.D. Rubin, “Using the Fluhrer, Mantin, and Shamir Attack to Break WEP,” NDSS 2002 Proceedings, §3.1.