A municipal CISO wants weekly evil-twin tests in the public lobby without change control or user communication. What process pushback is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Weekly lobby evil twins without a change ticket is chaos cosplay. Treat recurring offensive drills like any other risky exercise—schedule, approve, tell people. Skipping process because it is “just guest Wi-Fi” still bites.
Full Explanation
A municipal CISO who wants weekly evil-twin tests in the public lobby without change control or user communication should meet process pushback: require scheduling, approval, and communication like other security exercises—recurring offensive tests need change and approval discipline. Approving immediate weekly production evil twins because frequency equals maturity ignores bystander risk and outage potential. Moving tests to uncontrolled neighbor networks to avoid paperwork is unethical and illegal without those owners’ authorization. Skipping approval if only guest SSIDs are cloned still risks public confusion and RoE violations. Exam caveat: purple-team cadence is healthy only inside governance. Operational check: propose a quarterly authorized twin window with communications templates, abort criteria, and teardown ownership rather than uncontrolled weekly lobby experiments. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.