A procurement RFP for civic APs says only 'AES encryption' without specifying WPA2 versus WPA3. What should security reviewers demand?
Select an answer to reveal the explanation.
Short Explanation
Saying 'AES' is like ordering 'metal locks' with no brand, keyway, or door. Reviewers need WPA2 vs WPA3, Personal vs Enterprise, and PMF called out. Vague RFPs buy mystery boxes.
Full Explanation
AES appears in multiple Wi-Fi security generations and modes; naming the block cipher alone does not specify AKM, Personal versus Enterprise, transition behavior, or PMF policy. Civic RFPs should require explicit WPA2/WPA3 suite language and related controls so bids are comparable and enforceable. Assessors flag underspecified crypto bullets as incomplete security requirements.