A municipal wireless report marks a WPS finding critical because successful WPS abuse reveals the network PSK. What severity framing is that using?
Select an answer to reveal the explanation.
Short Explanation
WPS that coughs up the PSK is not a paper cut—it is the front-door key. Treat it like full SSID compromise because that is what a shared passphrase buys. Severity follows the keys, not the RSSI meter.
Full Explanation
Marking a WPS finding critical because successful WPS abuse reveals the network PSK uses severity framing based on credential and access impact: recovering the shared passphrase typically grants join rights equivalent to other PSK holders for that SSID, with corresponding confidentiality and lateral implications on that wireless segment. WPS issues are not automatically informational merely because PIN entry looks cosmetic on a sticker or GUI. Criticality does not require simultaneous WEP; WPS-to-PSK impact stands on its own for modern Personal networks. Severity should not be driven only by signal strength while ignoring credential exposure and who shares the passphrase. Exam caveat: severity still depends on demonstrated or clearly attainable recovery within scope, network sensitivity, and compensating controls—but passphrase recovery is not a low-impact cosmetic flaw. Operational check: in the municipal report, state whether WPS yielded or would yield the PSK, which SSID is affected, who shares that PSK, and what join or access follows; align the rating to that blast radius. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.