A Shared Passphrase, a Travel Router, and 40 Scanners

Rotating the PSK removes the contractor only until the next leak - and the lobby card is precisely the leak, by design. Anyone who reads a card can rejoin, and you cannot tell a former employee from a current one.

Be precise about what PSK does and does not do: WPA2-Personal derives a unique pairwise key per station, so one member cannot decrypt another member's unicast traffic. But every holder of the PSK can join, can derive the group key and read broadcast/multicast, and can impersonate the network. There is no per-user identity, no accountability, and no revocation that does not rekey all 300 users at once.

Deploy WPA2/WPA3-Enterprise with 802.1X: per-user credentials (EAP-TLS certificates preferred, PEAP-MSCHAPv2 acceptable with a strong password policy) against the existing directory via RADIUS. Then revoking the contractor is a single account disable that takes effect within one reauthentication interval, and the lobby card becomes worthless.

Also retire WPA/TKIP on the corporate SSID: TKIP is deprecated, blocks the 802.11n/ac high-throughput rates, and is not permitted in WPA3.

It is a rogue AP - an unauthorised access point bridging the wireless side to an authorised wired port. It is 'evil twin'-shaped only in that it reuses your SSID; the defining risk is the unmanaged bridge into your LAN.

Risks:

• It bypasses the wireless security architecture entirely; clients associating to it land on the corporate VLAN with no 802.1X, no VLAN assignment and no firewall policy.
• Because it advertises the corporate SSID, legitimate clients may roam onto it and hand their traffic to an unknown device (on-path interception).
• It may also be misconfigured and flood the channel with beacons, degrading nearby APs.

Response, in order:

1. Locate it physically. Use WIPS/controller rogue detection to get the BSSID, then trace the BSSID's wired MAC to a switch port (switchport tracing / CAM table correlation) and unplug it.
2. Fix the hole. Enable 802.1X or MAC authentication on edge switch ports, and disable unused wall jacks in conference rooms. A rogue AP is a symptom of an open port.
3. Do not rely on deauth containment. Transmitting disassociation frames at a third-party device is disruptive, can affect neighbouring legitimate clients, and may raise regulatory issues. Physical location is the reliable remedy.
4. Keep WIPS monitoring and alerting on.

Note the SSID reuse in the legitimate design too: WPA3 transition mode and PSK SSIDs are the easiest to clone convincingly. Enterprise authentication plus server certificate validation on clients means a rogue AP cannot complete the EAP exchange, and clients refuse to associate.

Isolate, do not integrate.

• Create a dedicated SSID mapped to its own VLAN - call it a device SSID - carrying only the scanners. Never let it share a VLAN or a security profile with the corporate SSID.
• Give it a distinct, long, randomly generated PSK, stored in the scanner management system, rotated on a schedule and on any scanner loss.
• Put ACLs on that VLAN permitting traffic only to the inventory/ERP server on the ports it needs, and nothing else - no internet, no file shares, no management subnets. Treat the VLAN as untrusted, because the credential is shared across 40 devices in a warehouse.
• Note the technical cost of TKIP: TKIP-only clients cannot use 802.11n/ac high-throughput rates. Enabling TKIP on a radio can force the whole BSS to protect frames and drop to legacy rates, so keep this SSID off APs that do not serve the warehouse, and consider a separate radio or band (2.4 GHz) for it.
• Confirm whether the scanners really are TKIP-only or merely WPA-Personal - many such devices support AES/CCMP with WPA2-Personal, which removes the TKIP penalty entirely and is a no-cost fix worth testing before designing around the worst case.
• Put scanner replacement on the roadmap; WPA-Personal/TKIP has no path forward into WPA3.