Security, Compliance, and Best Practices
Security is examined as configuration decisions
AWCC security items ask what a given setting does and which choice satisfies a requirement, not how to write policy prose. Know the mechanisms cold.
Mechanisms and rules
- WPA3-Personal uses SAE, which resists offline dictionary attacks; WPA3-Enterprise offers a 192-bit suite using GCMP-256, SHA-384, and Suite-B 802.1X.
- Protected Management Frames (802.11w) is optional in WPA2 and required in WPA3. It defends against forged deauthentication and disassociation.
- Enhanced Open (OWE) gives unauthenticated networks unencrypted-free traffic without a shared secret.
- 802.1X with RADIUS provides per-user credentials and can return dynamic authorization attributes such as VLAN or role.
- WIDS classifies discovered APs as known, neighbor, or rogue; containment is a separate, deliberate action with legal risk.
- Compliance regimes such as PCI DSS prohibit WEP, WPA/TKIP, and shared static keys on in-scope wireless.
Worked example
A store's wireless is in PCI scope and still permits WPA/TKIP for an old scanner. Correct order: confirm the scanner's capability, migrate the SSID to WPA2/WPA3 with AES-CCMP or GCMP, enable PMF, move authentication to 802.1X with certificates, segment the scanner onto its own VLAN, then verify with a capture that TKIP is no longer offered. Removing the cipher without validating the client first causes an outage.
Hardening baseline
Disable Telnet and HTTP management, use SSH/HTTPS with certificates, apply role-based access and centralized AAA for administrators, isolate guest and IoT traffic, keep firmware current, and retain logs for the required period.
Traps that cost marks
Believing a hidden SSID is a security control; confusing optional and required PMF; assuming WIDS contains threats automatically; leaving the management VLAN shared with guest traffic.