A security-minded technician points out that MAC authentication, used for the ward's older nurse-call panels, verifies a hardware address rather than a real credential. What is the practical risk this introduces compared to 802.1X?
Select an answer to reveal the explanation.
Short Explanation
A hardware address is more like a name tag than a password — anyone who reads it off can wear the same one. That's the tradeoff with MAC authentication: it's easy to onboard legacy gear with, but a spoofed address gets the same access as the real device.
Full Explanation
MAC authentication checks a value, the hardware address, that is broadcast in the clear on every frame a device sends and is trivial to observe and clone with common tools, so an attacker who captures an authorized device's MAC address can configure their own equipment to present that same address and be granted whatever role the legitimate device holds. This is the core tradeoff against 802.1X, where the credential exchanged is not something that can be sniffed off the wire and replayed the same way. Because of this, MAC-authenticated ports are typically paired with tightly scoped roles limiting what that device can reach, minimizing the blast radius if the address is cloned. MAC authentication does not require more RADIUS infrastructure than 802.1X; both can query the same RADIUS server, so infrastructure count is not the distinguishing risk. MAC authentication works on both wired ports and wireless associations, so restricting it to wireless only is incorrect. It also does not provide encryption on its own; encryption of the client's traffic is a separate function handled by WPA on wireless or by other mechanisms, not a side effect of how the device authenticated. A useful compensating check is periodically auditing which devices are using MAC authentication and confirming their assigned role still matches the minimum access that legacy device actually needs.