A university-affiliated municipal campus offers a self-service portal that issues unique WLAN credentials. What design caution still applies?
Select an answer to reveal the explanation.
Short Explanation
Unique credentials are great; an unlocked portal that hands them out is not. Harden the onboarding portal anyway. Cleartext email PSKs and skipped proofing undo the benefit.
Full Explanation
A university-affiliated municipal campus that offers a self-service portal issuing unique WLAN credentials must still secure that onboarding portal. Unique credentials reduce shared-PSK blast radius, but an unprotected portal that issues them becomes the new high-value target for account takeover and mass credential abuse. Design caution therefore focuses on TLS, identity proofing, rate limiting, and audit logging for the portal even when each issued secret is unique. Self-service portals do not get to skip TLS merely because the SSID uses WPA3; credential issuance is its own sensitive channel. Unique credentials do not mean the portal can skip identity proofing entirely—otherwise anyone can mint campus access. Emailing PSKs in cleartext to any address typed on the form undoes uniqueness benefits and exposes secrets in mail stores. Exam caveat: portal hardening includes protecting admin interfaces and credential databases—not only the student-facing form page shown in demos. Operational check: review the onboarding portal for HTTPS, authentication of requesters, and logging of issuance events; attempt a credential request without proofing in a test environment and confirm it is rejected before production use.