A help desk ticket claims an SSID is 'Enterprise' solely because the AP shows WPA2-AES. What clarification separates cipher from AKM?
Select an answer to reveal the explanation.
Short Explanation
AES is the language of the lock; Enterprise is how you prove who gets a key. You can use a strong AES cipher with a shared passphrase (Personal) or with 802.1X (Enterprise) — the cipher alone doesn't settle the AKM argument.
Full Explanation
AES/CCMP is a pairwise/group cipher suite choice; Authentication and Key Management (AKM) selects how keys are established—PSK (Personal) versus 802.1X (Enterprise). Help-desk tickets that call an SSID “Enterprise” solely because the AP shows WPA2-AES confuse cipher with AKM. Municipal assessors should read both fields: CCMP can appear on Personal or Enterprise networks, while Enterprise specifically denotes 802.1X-based AKM. Saying AES/CCMP can only exist on open networks is false. Claiming WPA2-AES always means RADIUS because AES is an AKM suite mislabels a cipher as an AKM. Asserting cipher and AKM are the same field so any AES network is definitionally Enterprise collapses distinct RSN components. Exam caveat: Classify Personal versus Enterprise from AKM advertisements, not from “AES” stickers alone. Operational check: Decode the civic BSS beacon RSN IE and record pairwise cipher and AKM separately on the worksheet before labeling the SSID Enterprise. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.