A help desk resets Enterprise Wi-Fi passwords verbally in an open county office. What operational weakness near Enterprise controls does that illustrate?

Help desks that reset Enterprise Wi-Fi passwords verbally in an open county office illustrate that social handling of EAP passwords undermines technical Enterprise controls. Verbal resets do not cryptographically rotate PMKs on every AP in the ESS automatically. Verbal resets are not preferred because PEAP cannot use directory passwords—PEAP commonly does use directory passwords, which makes public disclosure worse. Verbal resets do not convert the SSID from Enterprise to WPA3-SAE Personal without reboot. Exam caveat: identity operations are part of wireless security; cryptography cannot save credentials announced across a lobby. Operational check: move civic password resets to private channels or self-service portals, train help desks, and monitor for passwords spoken near public counters in service centers. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.