A library WLAN still runs SNMPv2c with the community string ‘public’ on APs. What should the designer do?
Select an answer to reveal the explanation.
Short Explanation
‘public’ on SNMPv2c is the spare key hanging on a hook labeled Spare Key. Turn off the old SNMP flavors or move to SNMPv3—do not recycle the Wi-Fi password as the community string.
Full Explanation
In municipal WLAN environments such as libraries, continuing to run SNMPv2c with the community string 'public' presents a significant security vulnerability. SNMPv2c uses community strings as a form of weak authentication, and 'public' is a well-known default value that attackers can exploit to gain unauthorized read or write access to network devices. The correct approach is to disable SNMPv1 and SNMPv2c protocols, which lack robust security features, or upgrade to SNMPv3. SNMPv3 introduces strong authentication and encryption mechanisms, ensuring that management traffic is protected against interception and tampering. Leaving SNMPv2c enabled with 'public' ignores the risk of unauthorized access, as this string is widely documented and easily guessed. Mirroring SNMPv1 traps to a guest SSID is illogical and insecure because management traffic should never be exposed to untrusted client networks; this would increase the attack surface unnecessarily. Using the Wi-Fi PSK as the SNMP community string conflates two distinct security domains and risks compromising both management and client authentication if either secret is exposed. It is important to note that transitioning to SNMPv3 may require firmware upgrades or additional configuration, so planning and testing are essential. To operationally verify proper security, administrators should confirm SNMPv1/v2c are disabled on APs and that SNMPv3 is configured with unique, strong credentials, limiting management access to trusted hosts only.