PCI DSS Exposure Across 42 Retail Stores
Halbrook Retail has 42 stores. Each store runs a SCAN SSID with WEP-40 for 15 handheld inventory scanners and an overlapping CORP SSID using WPA2-PSK with the same 20-character passphrase in all 42 stores. A PCI DSS assessor flagged the wireless configuration after finding a rogue AP in store 17 broadcasting CORP from a manager's travel router that had been plugged into the store switch. Store managers know the passphrase and share it with seasonal staff. The scanners are eight years old and support only WEP or 802.1X with EAP-TLS on 2.4 GHz. The chain's busy season starts in nine weeks, and store operations cannot pause for more than a two-hour window per store.
1. Rank the three findings (WEP, shared PSK, rogue AP) by risk and justify the order in PCI DSS terms.
Read the worked answer
Highest: the rogue AP. It is an unauthorized bridge on the store switch broadcasting the corporate SSID; that can bypass firewall segmentation and expose cardholder data, and it proves the switch port was not controlled. Next: WEP-40. It is trivially broken, so scanner traffic is effectively clear text, and it fails the PCI DSS intent for strong cryptography on wireless. Third: shared WPA2-PSK. The cipher is acceptable, but one key across 42 stores with managers and seasonal staff means no per-user attribution, no revocation without a chain-wide outage, and a single leak compromises every store. The rogue AP ranks first because it is an active unauthorized entry point; WEP is second because exploitation is trivial; PSK is third because it requires a key leak but is still a compliance failure.
2. A store manager suggests rotating the PSK every 30 days and enabling MAC filtering. Explain why this does not fix the finding.
Read the worked answer
Rotating the PSK every 30 days still gives every store the same secret and still requires distributing it to managers and seasonal staff. Anyone who has it can use it until the next rotation, and the rotation itself creates a support burden across 42 stores. MAC filtering is worse: MAC addresses are sent in clear in every frame, are easy to spoof, and maintaining a list of 15 scanners per store plus guest devices becomes an administrative job that will be bypassed. Neither provides per-device credentials, mutual authentication, or the ability to revoke one scanner without touching the rest. The PCI finding is about strong cryptography and access control; a shared PSK does not meet the intent for a multi-store cardholder environment. Move the scanners to WPA2-Enterprise with EAP-TLS and per-device certificates.
3. Build a nine-week migration plan that keeps each store's downtime under two hours.
Read the worked answer
Weeks 1-2: stand up RADIUS (or use the existing NPS/ISE) and an internal PKI; enroll certificates on a pilot store's 15 scanners and test EAP-TLS on 2.4 GHz. Week 3: pilot store cutover in a two-hour window; run a full shift of scanning before proceeding. Weeks 4-7: migrate six stores per week, two nights per week, each within a two-hour window; pre-stage certificates and configuration, and keep the WEP SSID disabled but present for one week as a fallback. Week 8: verify all 42 stores, remove WEP and PSK SSIDs, enable 802.1X on switch ports with MAB for scanners, and deploy rogue-AP detection. Week 9: buffer and audit evidence. Communicate the schedule to store managers and keep a rollback image for each scanner model.