A municipal wireless report recommends replacing PEAP-MSCHAPv2 on the county staff SSID with EAP-TLS and enforcing certificate validation. What makes that remediation high quality for Enterprise Wi-Fi risk?
Select an answer to reveal the explanation.
Short Explanation
PEAP-MSCHAPv2 is the soft underbelly of many Enterprise SSIDs—password-ish and trust-tricky. Jumping to EAP-TLS with real cert checks puts hard credentials and validated trust in play. Cleaning SSID cosmetics or sliding back to PSK is not remediation.
Full Explanation
Recommending replacement of PEAP-MSCHAPv2 on a county staff SSID with EAP-TLS and enforced certificate validation is high-quality remediation because moving to EAP-TLS or similarly strong certificate-based profiles plus enforced cert validation addresses common Enterprise credential and trust risks. The remediation is not mainly about shortening SSID names so airodump lists look cleaner. It should not force every guest kiosk onto WEP so staff PEAP stays untouched. It should not replace RADIUS with a shared PSK broadcast in the lobby for simplicity. Exam caveat: remediation quality includes lifecycle operations—enrollment, renewal, revocation—not only swapping the EAP method acronym in a slide. Operational check: pilot EAP-TLS on a municipal department, enforce validation via MDM, measure help-desk load, then expand while retiring PEAP-MSCHAPv2 profiles that allowed click-through trust failures. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.