A university campus that partners with the city for public events wants an annual wireless security assessment. What audit procedure fits, provided scope is clear?
Select an answer to reveal the explanation.
Short Explanation
Annual pen tests are the controlled stress test for campus Wi-Fi—scoped, authorized, and documented. Rules of engagement keep it professional, not chaotic. A happiness survey is not a security audit.
Full Explanation
An annual wireless security assessment for a university campus partnering with the city should be a controlled penetration test conducted within a clearly defined rules of engagement (ROE). This procedure involves authorized testers simulating attacks on campus Wi-Fi to identify vulnerabilities before adversaries exploit them. The ROE ensures testing is safe, legal, and scoped to avoid disrupting production services or violating privacy. Conducting such penetration tests annually helps maintain a robust security posture by uncovering configuration weaknesses, outdated firmware, or protocol flaws. Allowing unrestricted red-team attacks without ROE or notification risks unintended service outages, legal issues, and privacy violations, making it an impractical and unsafe approach. Replacing penetration testing with a marketing survey of student satisfaction ignores the technical security evaluation needed to detect vulnerabilities. Testing only unused lab SSIDs indefinitely while neglecting production Wi-Fi overlooks the primary attack surface and fails to provide meaningful security assurance. The scope must be explicitly defined to include production Wi-Fi networks and exclude sensitive systems as necessary. Operationally, the security team should develop and approve ROE documents with stakeholders, schedule penetration tests annually, and remediate identified vulnerabilities promptly.