Rogue AP Detection With High False Positives
A university's Aruba Mobility Conductor manages 400 APs across 12 buildings. WIDS/WIPS is enabled in 'detect only' mode. The security team receives roughly 300 rogue AP alerts per day, mostly in lecture halls and dormitories. Most alerts are personal hotspots and campus-owned APs that were temporarily misclassified. The team wants to move to containment but is worried about disrupting legitimate devices and about legal risk. They have a list of authorized BSSIDs but it is incomplete. The campus has a strict policy against jamming.
1. How should the team reduce false positives before enabling any containment?
Read the worked answer
First, build an accurate authorized-MAC/BSSID list by importing the full campus AP inventory and any sanctioned third-party APs, and enable 'classify as known' for those. Second, tune the rogue classification thresholds (RSSI and number of sightings) so transient personal hotspots in lecture halls do not trigger high-severity alerts. Third, use containment only for specific, verified rogue categories, not blanket auto-containment. Fourth, review alerts over a defined period (e.g., two weeks) to establish a baseline and identify recurring false positives. Only after the authorized list is complete and alert volume is manageable should containment be considered, and then only in a targeted, time-bounded manner.
2. What are the operational and legal considerations for containment, and how would you implement it safely?
Read the worked answer
Containment (deauth) can disrupt neighboring networks and may violate regulations depending on jurisdiction, so it must be policy-approved and scoped. Implement safely by: (1) enabling containment only for confirmed rogues on the campus interior, not for APs seen at the perimeter; (2) using targeted containment rather than wide-area; (3) requiring human approval or a defined escalation workflow before containment; (4) logging all containment actions for audit; (5) setting a maximum containment duration and automatic expiry; (6) coordinating with legal/compliance. Validate by testing containment against a known test AP in a lab SSID and confirming the rogue client is deauthenticated while legitimate clients are unaffected.