A county asks if hiding the SSID plus enabling WEP equals defense-in-depth for staff Wi-Fi. What should the assessor answer?
Select an answer to reveal the explanation.
Short Explanation
Hiding the network name is pulling the curtains, and WEP is a cardboard lock. Neither stacks into real defense-in-depth. County staff need modern AKM and ciphers, not security-by-embarrassment.
Full Explanation
Hiding an SSID and enabling WEP does not equal defense-in-depth for county staff Wi-Fi. Hidden SSIDs leak through client activity, and WEP remains cryptographically broken. Real security requires modern AKM and ciphers—WPA2/WPA3 with sound configuration—not stacked obsolete controls. Assessors should reject obscurity-plus-WEP narratives in municipal standards reviews. Saying obscurity plus WEP meets modern RSN baselines when combined is false. Claiming a hidden SSID alone provides PMF-equivalent protection against deauthentication invents a management-frame defense hiding does not provide. Preferring WEP with a cloaked SSID over WPA3 for low-power IoT carts recommends the worse baseline. Exam caveat: Stacking weak controls rarely reaches the strength of one strong RSN profile. Operational check: Demonstrate SSID discovery despite hiding and WEP weakness on a lab staff SSID under RoE, then show a WPA3 or WPA2-CCMP profile as the compliant alternative. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.