WPA3 Mandate Against Legacy Clinical Devices
A 420-bed hospital operates a single WPA2-Enterprise SSID, MEDNET, carrying roughly 3,900 devices: workstations on wheels, nurse-station PCs, VoWiFi handsets and 640 clinical devices. Of those, 210 bedside monitors support only WPA2-PSK with AES-CCMP and do not implement 802.11w; another 90 infusion pumps support WPA2-Enterprise but not WPA3. A security audit requires WPA3-Enterprise 192-bit on MEDNET within 90 days and OWE on the guest network. The wireless team's plan is to switch MEDNET in one 02:00–04:00 window to WPA2/WPA3 transition mode with PMF required, enforce 192-bit mode the following month, and move the 210 monitors onto a new open SSID with a captive portal "because they will associate with anything". Clinical engineering requires zero unplanned device downtime, and any change must be reversible within the same window. The identity team can issue certificates to managed endpoints but has no process for the 210 monitors.
1. Evaluate the migration plan and identify the elements most likely to cause clinical downtime or a security failure.
Read the worked answer
The plan fails on three counts. Setting PMF to required immediately drops every client that does not implement 802.11w, which includes the 210 monitors and an unknown share of the other 3,700 devices; they will not associate at all, and the failure will surface at 02:00 with no clinical staff on hand to notice. Second, transition mode cannot deliver the audit requirement: 192-bit mode is WPA3-only, uses GCMP-256 and SHA-384 with certificate-based EAP-TLS, and cannot be run alongside WPA2 clients on the same SSID, so the following month's cutover is the real outage risk, not this window. Third, an open SSID with a captive portal for bedside monitors is both a security failure (unencrypted patient data in transit) and an operational one, since these devices generally have no browser to complete a portal. The correct pattern is separate SSIDs per security class, moved at the speed of the slowest device in each class.
2. Design a phased migration that satisfies the audit intent without clinical downtime, distinguishing device groups and what each SSID enforces.
Read the worked answer
Inventory first: pull association logs and vendor statements to classify every device by WPA3 support, PMF capability and 802.1X support before changing anything. Then build the target state as separate SSIDs. A WPA3-Enterprise 192-bit SSID for managed workstations and nurse-station PCs with certificates from the identity team; a WPA2-Enterprise AES SSID with PMF capable (not required) and 802.11r enabled, retained for the VoWiFi handsets and the 90 pumps that cannot do WPA3; and a dedicated clinical-device SSID for the 210 monitors using WPA2-PSK with AES and a random pre-shared key rotated on a documented cycle, mapped to a segmented VLAN with ACLs so the monitors reach only their management servers. Guest moves to OWE transition mode. Each SSID carries one security policy and one VLAN, so regulatory scope can be documented. Decommission the legacy SSIDs only after the monitor fleet is replaced, and treat that hardware refresh as the audit remediation, not a configuration change.
3. What would you verify inside each change window, and what is the rollback trigger and procedure?
Read the worked answer
Before the window, capture a baseline: association success rate per device class, authentication failures on MEDNET, and a named test device from every class (a workstation, a handset, a pump, a monitor, a guest phone). Provision new SSIDs and their VLAN and firewall rules first in a no-impact change, because adding an SSID interrupts nobody; only then migrate devices. Inside the window, associate one test device per class and hold the session for at least 15 minutes, checking RADIUS accept logs and post-association DHCP and application reachability. Rollback trigger: any class fails to associate, or more than an agreed number of authentication failures beyond baseline within 30 minutes. Rollback is procedural, not a rebuild: leave the old SSID broadcasting during a parallel run of at least two weeks, revert PMF to optional and re-enable the legacy SSID, which returns the fleet to its pre-change state quickly because the old credentials were never removed. Require clinical engineering sign-off before any device class is moved.