Guest Wi-Fi and PCI Scope in a Retail Chain
A retail chain has 60 stores. Each store has a guest SSID using WPA2-PSK with the same passphrase across all stores, a POS terminal on wired VLAN 10, and a store-manager laptop on VLAN 20. The guest SSID maps to VLAN 30. The store firewall routes between VLANs 10, 20, and 30 with a permit-any rule because the POS vendor needs to reach a cloud payment gateway. A recent PCI DSS assessment flagged the guest network as in scope because the assessor could reach the POS management web page from a guest device. The chain wants to keep guest Wi-Fi for customers and avoid replacing POS terminals. It has a RADIUS server but no 802.1X on guest.
1. Identify the scope and compliance problem and the immediate containment actions. Explain why changing only the guest Wi-Fi encryption would not fix the finding.
Read the worked answer
The finding is not primarily a Wi-Fi encryption problem; it is a segmentation problem. The guest VLAN 30 can route to the POS VLAN 10 because the firewall has a permit-any rule. That means a guest device can reach the POS management web page and potentially other POS services. Under PCI DSS, the cardholder data environment must be segmented from untrusted networks, and guest Wi-Fi is an untrusted network. If guest traffic can reach the POS management interface, the assessor can argue that the guest network is connected to the CDE and is therefore in scope. Changing WPA2-PSK to WPA3 or adding a captive portal would not remove that path. The immediate containment is to remove the permit-any rule and replace it with explicit deny-by-default rules. Guest VLAN 30 should be denied to VLAN 10 and VLAN 20 in both directions, with logging. The POS vendor's cloud gateway access should be allowed only from the POS VLAN to specific destination IPs and ports, not from guest. The POS management web page should be reachable only from a management VLAN or jump host with MFA. Because the same PSK is used across all 60 stores, a compromise at one store compromises guest access everywhere; rotate the PSK immediately, preferably to per-store credentials or a captive portal. Also enable client isolation on the guest SSID to prevent guest-to-guest attacks.
2. Propose a target segmentation and authentication design for guest, manager, and POS traffic. Address whether guest Wi-Fi should use PSK, 802.1X, or OWE.
Read the worked answer
The target design should use separate trust zones with default-deny firewall policy. POS traffic stays on VLAN 10, wired where possible, with strict egress rules to the payment processor's published IP ranges and ports. POS management should be on a dedicated management VLAN, not on VLAN 10, and reachable only through a hardened jump host with MFA. Store-manager laptops should use 802.1X EAP-TLS on VLAN 20, with RADIUS posture or group checks if available. Guest traffic should be on VLAN 30 with no routing to VLAN 10 or VLAN 20. The guest SSID can use WPA3-SAE with a per-store unique passphrase, or OWE for an open-style guest experience with encryption. WPA2-PSK with one shared global key is the weakest option because it gives every store the same credential and does not identify users. 802.1X on guest is possible but usually creates too much support burden for customers; a captive portal with sponsored or self-registration is more practical. If a captive portal is used, the pre-authentication walled garden should allow only DNS, the portal, and the payment or SMS provider, not internal POS destinations. Apply client isolation, rate limiting, and band steering on guest. For the manager VLAN, 802.1X is appropriate because the users are known employees. The key control is that no guest VLAN interface can route to the POS or management VLANs, even if the Wi-Fi password is compromised.
3. What evidence would you give the PCI assessor to demonstrate that segmentation is effective, and what ongoing controls should be added?
Read the worked answer
The evidence should show both configuration and test results. Provide the firewall rule set with the default-deny policy, the specific allow rules for POS-to-payment-gateway traffic, and the VLAN interface configuration. Provide a network diagram showing the CDE boundary, the POS VLAN, the management VLAN, the manager VLAN, and the guest VLAN. Then provide a segmentation test from a guest VLAN host: attempt to reach the POS management web page, scan the POS subnet, and attempt to reach manager resources; all should fail, and the firewall logs should show denies. Repeat the test after any firewall change. Include the guest SSID configuration showing client isolation and the absence of a global PSK, and the 802.1X configuration for manager devices. For PCI DSS v4.0, also document MFA for all administrative access into the CDE, quarterly ASV scans, annual penetration testing, and change-management records. Ongoing controls should include automated firewall rule review, alerts on any permit rule from guest to internal VLANs, quarterly segmentation tests, per-store credential rotation, and monitoring of POS egress for unexpected destinations. The assessor is looking for proof that guest compromise cannot lead to cardholder data, not just a statement that the networks are separate.