WIPS and switch logs show an employee laptop bridging the city WLAN to a personal hotspot via Windows Internet Connection Sharing. How should this be treated?
Select an answer to reveal the explanation.
Short Explanation
That laptop just became a soft rogue onboarding random networks into yours. Call it a policy violation and shut the bridge down. Whitelisting ICS is how soft rogues get a parade.
Full Explanation
WIPS and switch logs showing an employee laptop bridging the city WLAN to a personal hotspot via Windows Internet Connection Sharing should be treated as unauthorized client bridging—a soft-rogue policy violation—remediated via endpoint controls and awareness. Bridging extends trust and can hairpin traffic outside monitored paths. Civic acceptable-use and NAC programs should explicitly forbid ICS-style bridging on managed endpoints.
Encouraging bridging so home ISPs provide free backhaul for city APs is not an enterprise design. Whitelisting all ICS adapters because they improve seamless roaming metrics invents a false RF benefit. Disabling switch port security so bridged frames flood faster for testing worsens the problem.
Exam caveat: soft-rogue detection quality varies by vendor—pair WIPS with endpoint policy that disables ICS/hotspot bridging features. Operational check: reproduce ICS bridging on a lab laptop, confirm detection/alert, block via MDM/endpoint policy, and verify the production alert maps to the soft-rogue playbook. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.