A county compares password-spray risk on Enterprise Wi-Fi usernames discovered via EAP. What chained risk should the brief note?
Select an answer to reveal the explanation.
Short Explanation
Usernames leaking from EAP are breadcrumbs to the directory door. If nobody watches, spray classes may follow—call that chained risk, not a free PSK or a WPS-only problem.
Full Explanation
Password-spray risk on Enterprise Wi-Fi usernames discovered via EAP is a chained risk: exposed EAP identities can feed password attacks against directories and VPN portals if not monitored. EAP usernames do not cryptographically include the PSK, so spraying is not unnecessary once identities are seen—identity exposure is the enrichment step. EAP usernames do not prove WPS is enabled or limit spray risk to eight-digit PIN space. EAP usernames do not automatically rotate daily in most municipal directories. Exam caveat: wireless recon can become an identity-attack input; reports should connect those dots for SOC use cases. Operational check: protect identity lists from engagement artifacts, enable monitoring for spray patterns against civic directories, and adopt anonymous outer identities where AAA supports them without breaking accounting needs. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.