A clinic asks whether MAC filtering can substitute for WPA2 or WPA3 on the care-team SSID. What should the assessor conclude?
Select an answer to reveal the explanation.
Short Explanation
MAC filtering is like checking jackets at the door by color—anyone can grab a matching coat. It does not encrypt the air and spoofing is trivial. Clinics still need real WPA2/WPA3 crypto, not an allow-list costume party.
Full Explanation
MAC address filtering is trivially spoofed on 802.11 networks because observed STA MACs can be impersonated. It must not substitute for WPA2 or WPA3 encryption and authentication on a clinic care-team SSID. Assessors should conclude that allow-lists are a weak ancillary control at best and provide neither meaningful confidentiality nor robust authentication compared with modern RSN suites. Claiming MAC filtering replaces encryption if the allow-list stays under fifty addresses invents a size-based security myth. Saying MAC filtering plus a hidden SSID equals CCMP confidentiality stacks two weak controls. Asserting MAC filtering is required by 802.11 before any RSN cipher can negotiate is false. Exam caveat: Do not accept “we have MAC filtering” as remediation for open or WEP findings. Operational check: Under RoE in a lab clinic SSID, demonstrate that changing a STA MAC to an allowed value bypasses the filter while strong WPA2/WPA3 still governs real access. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.