A council member’s unmanaged personal phone requests the high-trust finance SSID. Policy requires MDM for that SSID. What should the design do?
Select an answer to reveal the explanation.
Short Explanation
High-trust SSIDs are the vault; unmanaged phones without MDM do not get the vault combination. Point them to a restricted guest or contractor network and keep finance locked down. Promises, emailed PSKs, and blind spots are not controls.
Full Explanation
When a council member’s unmanaged personal phone requests access to a high-trust finance SSID requiring Mobile Device Management (MDM), the design should prevent such unmanaged BYOD devices from joining the sensitive network. Instead, offering a restricted guest or contractor network path maintains security boundaries and policy compliance. Allowing the phone on the finance SSID based on a user’s promise to install antivirus later is unreliable and violates security best practices, as policy enforcement must be automated and verifiable. Sharing the enterprise pre-shared key (PSK) via email for quick access risks key compromise and unauthorized access, undermining network security. Disabling Wireless Intrusion Prevention System (WIPS) monitoring whenever elected officials connect removes critical threat detection, exposing the network to potential attacks. The essential principle is that sensitive SSIDs must enforce strict access controls and device compliance, while less-trusted devices receive limited network access. The design should also consider user experience by providing alternative connectivity options that do not compromise security. Operationally, confirm that the MDM enrollment status is checked before granting SSID access and that non-compliant devices are redirected to a guest network with limited privileges.