Staff receive phishing messages asking them to “re-enter Wi-Fi credentials” on a lookalike city portal. What mitigation belongs in the WLAN security program?
Select an answer to reveal the explanation.
Short Explanation
Phishing for Wi-Fi passwords is social engineering with an antenna. Train people, point them at the real join path, and lean on designs that don’t live or die on a shared secret people will type into fake pages. Reusing Wi-Fi passwords everywhere is pouring gasoline on the problem.
Full Explanation
Phishing messages that ask staff to “re-enter Wi-Fi credentials” on a lookalike city portal target both people and weak shared-secret designs common in municipal IT. A WLAN security program should combine user awareness, official onboarding channels, and technical controls that reduce reliance on phishable shared Wi-Fi secrets where possible—favoring 802.1X/EAP and managed profiles for employees. Civic workforces are frequent targets because a single PSK can unlock broad internal access.
Instructing users to reuse the Wi-Fi password for email increases credential-stuffing blast radius across systems. Disabling awareness because phishing is “only an email problem” ignores portal and evil-twin variants aimed at wireless secrets. Posting the enterprise PSK in the phishing email so staff can compare strings is operationally absurd and spreads the secret further.
Exam caveat: awareness without reducing shared PSKs on high-value SSIDs leaves a permanent phishable secret in circulation. Operational check: confirm employee SSIDs use enterprise authentication where feasible, publish the only official onboarding URLs or apps, and run a simulated Wi-Fi credential phish to measure report-and-escalate rates.