A city IT team manages tablets used by building inspectors on the staff WLAN. How should MDM best reduce evil-twin risk for EAP?

To effectively reduce the risk of evil-twin attacks in a municipal WLAN environment where building inspectors use tablets with EAP authentication, the best practice is to push Wi-Fi profiles via Mobile Device Management (MDM) that include the enterprise SSID settings along with pinned RADIUS server certificate trust. This approach ensures that the tablets only connect to the legitimate city WLAN by validating the RADIUS server's certificate during the EAP process, preventing attackers from impersonating the authentication server. Pinning the server certificate means the client explicitly trusts only the known certificate, blocking connections to rogue APs that mimic the SSID but present fraudulent certificates. Conversely, publishing the WPA passphrase on laminated cards inside inspection trucks exposes sensitive credentials physically, enabling attackers to easily obtain and misuse them, which undermines security. Allowing inspectors to pick any open SSID resembling the city name removes control over trusted networks and opens the door to connecting to malicious APs, defeating the purpose of secure EAP authentication. Disabling certificate checking to speed roaming sacrifices a core security mechanism that prevents man-in-the-middle attacks, making devices vulnerable to evil twins. It is important to note that certificate pinning requires proper certificate lifecycle management to avoid connectivity issues during certificate renewals. As an operational check, verify that tablets only connect to the enterprise SSID and reject connections when presented with invalid or untrusted RADIUS server certificates, confirming that evil-twin mitigation is active.