A museum exhibit controller only supports WEP. A technician suggests hiding the SSID so WEP is 'safe enough.' What is the correct mitigation approach?
Select an answer to reveal the explanation.
Short Explanation
Hiding the SSID is a 'please don’t look' sign on a glass door—WEP still shatters. Swap that exhibit box or park it on a tightly isolated network; do not pretend invisibility fixes broken crypto.
Full Explanation
A museum exhibit controller that only supports WEP remains cryptographically unacceptable no matter how the SSID is broadcast. Correct mitigation is to replace the controller with gear that supports modern WLAN security or to tightly isolate the WEP-only endpoint on a constrained VLAN with compensating monitoring—hiding the SSID does not redeem WEP. Keeping WEP with cloaking as the long-term primary control leaves frames recoverable by anyone who discovers the BSS. Publishing the WEP key on an exhibit plaque maximizes unauthorized access. Disabling museum firewalls so the WEP device can roam freely expands blast radius from a known-weak link. Exam caveat: isolation is a compensating control with residual risk, not a permanent substitute for eliminating WEP; exam stems that offer cloaking as salvation for WEP are testing whether you reject cosmetic mitigations. Operational check: place the exhibit controller on an isolated VLAN with no path to collection databases, schedule hardware replacement, verify WEP is gone after cutover, and update the museum OT/WLAN exception register with owner and sunset date. Civic cultural institutions should treat visitor-facing Wi-Fi and exhibit controllers under the same deprecated-crypto policy as city hall, not as informal exceptions.