County WLAN APs have known CVEs fixed only in newer firmware. Which preventative measure aligns with CWSP infrastructure hardening?
Select an answer to reveal the explanation.
Short Explanation
Firmware updates are the locksmith visit after the city publishes a broken-lock notice (CVE). Renaming the SSID is painting the door a new color while the old lock stays broken.
Full Explanation
Applying firmware and software updates to patch known Common Vulnerabilities and Exposures (CVEs) on county WLAN Access Points (APs) is a fundamental preventative measure that aligns directly with the CWSP framework for infrastructure hardening. Firmware updates serve as critical maintenance controls by incorporating security patches that remediate identified vulnerabilities, thereby reducing the attack surface available to potential adversaries. This proactive approach ensures that APs are fortified against exploits that could compromise confidentiality, integrity, or availability of municipal wireless networks. Conversely, freezing firmware indefinitely after the initial installation is a flawed strategy because it leaves devices susceptible to known and emerging threats. Without applying patches, vulnerabilities remain open doors for attackers, undermining the network’s security posture. Downgrading to older firmware versions based on informal sources such as vendor blog screenshots is equally problematic; it risks reintroducing previously resolved security issues and can destabilize the AP’s operational reliability. Such actions deviate from best practices and may void vendor support. Renaming SSIDs in response to CVE disclosures is a superficial tactic that does not mitigate the underlying vulnerabilities. While changing SSIDs might slightly obscure the network, it does nothing to prevent exploitation of firmware flaws and can confuse legitimate users, potentially disrupting service. The scope of this preventative measure includes establishing a regimented update cycle, where patches are first tested in controlled environments to avoid operational disruptions, then deployed promptly across all APs. Operationally, administrators must maintain an accurate inventory of firmware versions, monitor vulnerability disclosures, and coordinate updates to ensure consistent protection. This disciplined patch management process is essential to uphold the security and reliability of county WLAN infrastructure in a civic context.