Before a parks-department WLAN assessment, the city wants preventive guidance on passphrase strength for remaining WPA2-Personal SSIDs. What recommendation best reduces typical offline dictionary wins?

Before a parks-department WLAN assessment, preventive guidance for remaining WPA2-Personal SSIDs should prefer long random passphrases or migrate sensitive SSIDs to Enterprise authentication where practical. That guidance best reduces typical offline dictionary wins against civic guest and IoT networks. Seasonal slogans and reused acronyms are what crackers expect.

'Short seasonal slogans rotated weekly because dictionaries cannot learn seasons' fails because short seasonal slogans remain dictionary-friendly even if rotated weekly. 'Reuse one eight-character civic acronym across all guest and IoT SSIDs for consistency' fails because reusing one eight-character civic acronym across SSIDs maximizes blast radius instead of helping. 'Disable all encryption so assessors have nothing to recover during the engagement' fails because disabling encryption so assessors have nothing to recover destroys confidentiality rather than hardening.

Exam caveat: guidance must be actionable for device constraints—some IoT gear cannot do Enterprise, but it can still use long random PSKs. Operational check: inventory parks SSIDs, classify which can move to Enterprise or SAE, enforce random PSK policy elsewhere, and ban slogan-style secrets in municipal configuration standards. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.