The county's quarterly phishing drills only use email lures and never mention fake captive portals or evil-twin Wi-Fi prompts. What awareness gap should the CWSP flag?
Select an answer to reveal the explanation.
Short Explanation
Email phishing is only half the con. Teach city staff that a look-alike captive portal or evil twin can steal credentials just as fast—wireless social engineering belongs in the awareness plan.
Full Explanation
When the county's quarterly phishing drills use only email lures and never mention fake captive portals or evil-twin Wi-Fi prompts, the CWSP should flag an awareness gap: expand awareness content to include WLAN-specific social engineering such as fake captive portals and evil-twin prompts. Wireless users are routinely tricked by look-alike SSIDs and credential harvesters that never touch the email path; email-only drills leave that blind spot untested. Replacing all awareness training with a single RF math quiz for every stakeholder mismatches audience and threat. Assuming wireless users never fall for social engineering so email-only drills suffice is contradicted by common evil-twin and portal phishing patterns. Stopping phishing simulations entirely because Wi-Fi authentication supposedly proves user intent ignores that users can be convinced to join the wrong network or type passwords into fake portals. Civic staff who roam between buildings and public spaces especially need wireless-themed scenarios. Exam caveat: awareness programs should cover the channels attackers actually use against WLAN users, not only the channels that are easiest to simulate by email. Operational check: add at least one fake-portal or evil-twin recognition module to the quarterly program, measure report rates for suspicious SSIDs and portals, and update helpdesk runbooks so WLAN phishing reports are triaged like email phishing.