An organization's network has been the target of several cyberattacks. Which strategy should the organization use for Wi-Fi hardening?

Disabling the Extended Service Set Identifier (ESSID) broadcast is a Wi-Fi hardening technique known as network cloaking. This action prevents the access point from openly advertising the network's name, making it invisible to casual observers scanning for available Wi-Fi networks. While determined attackers can still discover the network using specialized tools, this measure hardens the network by reducing its visibility and protecting it from unsophisticated, opportunistic attacks. It is a layer in a defense-in-depth security strategy.

A. Trust local hosts by default: This practice violates the principle of least privilege and the zero-trust security model. It inherently weakens security by assuming internal devices are not a threat.

C. Add more access points: This action expands network coverage and capacity but does not inherently improve security. In fact, it can increase the attack surface if not configured securely.

D. Implement wired equivalent privacy (WEP): WEP is a deprecated and highly insecure encryption protocol with well-known vulnerabilities that can be exploited in minutes. Using WEP would severely weaken, not harden, network security.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-153

Guidelines for Securing Wireless Local Area Networks (WLANs).

Section 3.2.3

"Service Set Identifier (SSID) Management

" discusses SSID cloaking (disabling the broadcast) as a technique that "can hide the presence of a WLAN from casually snooping attackers."

Section 3.3.1

"WLAN Cryptography

" explicitly states

"WEP has been found to have significant security flaws and should not be used."

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. https://doi.org/10.1109/PROC.1975.9939

Section I.A.3

"Principle of Least Privilege

" establishes the foundational security concept that is violated by option A ("Trust local hosts by default"). This principle dictates that any entity should only have the bare minimum privileges necessary to perform its function.

3. Cisco. (2021). Wireless LAN Security Best Practices. Cisco Press.

In guides on WLAN security

adding access points (Option C) is discussed in the context of network design for coverage and capacity

not as a primary security hardening measure. Secure configuration of each AP is the focus for hardening.