A capture inside city hall shows repeated client probe requests for a home SSID. How should the assessor treat that finding?
Select an answer to reveal the explanation.
Short Explanation
Phones shout the names of networks they miss—including someone's home Wi-Fi—while sitting in city hall. Write it up as an awareness note about leaky probes. It is not a hall pass to go crack Grandma's router.
Full Explanation
Repeated client probe requests for a home SSID inside city hall are a privacy/OPSEC awareness finding about preferred-network leakage: devices advertise networks they trust, which can reveal employee home Wi-Fi names. That is useful for awareness coaching, not a license to attack the home network named in the probes. Civic assessors report the leakage risk carefully. Treating probe leakage as authorization to attack the home network fails by concept: observing a name is not consent or RoE coverage for that home BSS. Ignoring probes entirely as never privacy-relevant fails by concept: preferred-network lists are classic OPSEC leakage. Using the home SSID string as the corporate PSK without evidence fails by concept: SSID ≠ passphrase. Exam caveat: minimize retention of employee home SSIDs in lasting reports—summarize the pattern without publishing unnecessary personal network names. Operational check: note probe leakage as an awareness finding, recommend private DNS/probe mitigations or user education per city policy, and do not target external home BSSIDs from the engagement. In civic practice, write the decision and the verification command into the engagement notes so another assessor can repeat the check on the next shift without rediscovering the same pitfall under time pressure.