WLAN Security Fundamentals and Risk Assessment
This domain tests whether you can reason about wireless risk the way an assessor does: identify the assets, map threats to the specific exposures created by an RF medium that walls cannot contain, quantify likelihood and impact, and choose controls that actually reduce risk rather than merely satisfy a checklist. Questions in this domain typically present a scenario and ask which control, metric, or framework applies.
Vocabulary the exam uses precisely
- Asset, threat, vulnerability, exposure, control. A vulnerability is a weakness; a threat is who or what could exploit it; risk is the combination.
- Qualitative risk: likelihood x impact matrices, risk registers, heat maps.
- Quantitative risk: SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).
- Defense in depth, least privilege, separation of duties, AAA (authentication, authorization, accounting).
- Threat actors: opportunistic outsiders, malicious neighbors, insiders, and automated malware that spreads through ad-hoc SSIDs and auto-connecting clients.
- Wireless-specific exposures: RF spillage beyond the physical perimeter, promiscuous client behavior, rogue and evil twin APs, weak pre-shared keys, default credentials on controllers, unprotected management frames, deauthentication floods, and physical theft of APs.
Frameworks and method
NIST SP 800-30 structures the assessment: scope and asset inventory, threat identification, vulnerability identification (configuration review plus an active wireless scan), risk determination, control selection, and acceptance of residual risk. NIST SP 800-153 gives WLAN-specific guidance. ISO/IEC 27005 and OCTAVE are acceptable alternatives. The method matters less than showing the chain from asset to control.
Worked example
A retail chain has 40 stores. A laptop holding cardholder data is valued at 3,000 USD and a compromise would destroy 60 percent of that value, so SLE = 1,800 USD. Historical data suggests one exposure event per store every four years, so ARO = 0.25. ALE = 450 USD per store, or 18,000 USD across the chain. A WIPS overlay plus WPA3-Enterprise costs 14,000 USD per year, so the control is justified on quantitative grounds. Note what the model omits: reputational damage, regulatory penalty, and forensic cost. Stating that limitation is often what separates a full-credit answer.
Traps that cost marks
- Treating SSID hiding, MAC filtering, or reduced transmit power as security controls rather than friction.
- Confusing a vulnerability with a threat, or quoting an ALE without stating its assumptions.
- Forgetting that RF containment is a site-survey and antenna design control, not a cryptographic one.
- Assuming a compliance checklist is the same thing as a risk assessment.