A security whiteboard at the water treatment plant labels “CCMP/GCMP” as protecting all 802.11 management and data frames equally. What correction belongs in the design notes?
Select an answer to reveal the explanation.
Short Explanation
Data ciphers wrap the payload traffic; management-frame protection is a different seatbelt for deauth and friends. Mixing those labels on the whiteboard confuses monitoring and hardening plans. Keep data encryption and MFP as sibling controls, not one blob.
Full Explanation
At the water treatment plant security whiteboard, CCMP and GCMP must be described accurately as link data ciphers that protect data frames under the selected RSN suite. Management frame protection (MFP/PMF) is a separate control for authenticating and protecting selected management frames such as deauthentication and disassociation. Conflating the two leads to incomplete hardening: strong data ciphers without PMF still leave classic management-frame attacks available against plant WLAN clients and APs. CCMP does not exist merely to encrypt RADIUS shared secrets on the controller; it protects air data frames when negotiated as the pairwise or group cipher. GCMP is not a captive-portal cookie algorithm and should not be reduced to an application convenience feature. DHCP option 43 does not encrypt management frames and is unrelated to MFP/PMF mechanics. Exam caveat: some management frames historically remained unprotected even when data ciphers were strong—whether PMF is optional or required is an explicit design choice that must appear in the plant WLAN standard. Operational check: list data-cipher requirements and PMF requirements on separate lines in the design notes, then validate a client association shows both the expected pairwise cipher and the intended PMF capability or policy enforcement before accepting the configuration as production-ready.