Distribution Center Network and Physical Access
Ridge Logistics operates six distribution centers. Each center has 180 wireless barcode scanners, 40 IP cameras, 25 badge readers, and a guest Wi-Fi network on the same Layer 2 domain. At the Denver site, overnight staff reported that a badge reader at a loading dock sometimes unlocks with any valid employee badge, including terminated employees, for up to 10 minutes after termination. Facilities found a wireless access point plugged into a dock office wall jack, broadcasting the corporate SSID with no password. The cameras record to a local NVR with default credentials. The company uses a single shared WPA2-PSK for scanners and laptops. The CISO wants a 60-day remediation plan before peak season. Two Denver dock doors also lack cameras, and the badge system's HR feed updates nightly.
1. Propose a 60-day remediation priority order for the Denver site and explain the sequence.
Read the worked answer
Sequence by active exposure, then architecture. Hours 1-24: remove the rogue access point and preserve its logs; change NVR defaults and isolate the NVR; force the badge system to sync HR terminations immediately, manually revoke the terminated employees, and add a camera and badge-plus-PIN at the two Denver doors. Days 1-30: create separate VLANs for scanners, cameras, badge readers, guest, and corporate laptops, with deny-by-default ACLs so a compromised camera cannot reach badge controllers. Enable 802.1X or MAC-based port security on switch ports. Days 31-60: replace shared WPA2-PSK with per-site credentials for scanners and EAP-TLS for laptops, and add monitoring for rogue APs. Reasoning: the rogue AP and termination delay are immediate physical and credential risks; segmentation limits lateral movement; the shared PSK is serious but takes longer to migrate without breaking 180 scanners per site.
2. Replacing the shared WPA2-PSK with 802.1X is proposed. What obstacles do you expect, and what compensating controls would you apply?
Read the worked answer
Assume some scanners cannot do 802.1X. Many handheld scanners support only PSK or LEAP, so a forced EAP-TLS migration could halt receiving. Inventory scanner models and firmware first. Put scanners on a dedicated SSID mapped to the scanner VLAN, use a unique high-entropy PSK per site if per-device credentials are unsupported, rotate quarterly, and restrict the VLAN to the warehouse management system. Compensate with NAC profiling, MAC authentication bypass, and anomaly alerts for scanner MACs appearing on other ports. For laptops, require EAP-TLS with certificate-based identity and device compliance. Do not let the scanner PSK unlock corporate resources: the VLAN ACL should allow only the WMS endpoint and block internet and badge traffic. If a scanner supports 802.1X, migrate those first and track coverage as a percentage; the residual risk is a stolen PSK, contained by segmentation and rotation.