Radio-access threat model
Wireless coverage does not stop at a building wall. An attacker can observe or transmit from a location outside administrative control. The threat model must address confidentiality, integrity, authentication, and availability.
Hidden SSIDs, MAC-address filtering, and reduced transmit power do not provide reliable authentication. They can reduce casual discovery but remain observable or bypassable.
Impersonating and unauthorized access points
- An can intercept traffic or direct clients to false services.
- A rogue access pointis an unauthorized device attached to the organization's network and can bypass perimeter policy.
- A user-created hotspot on a managed laptop or telephone can form an uncontrolled network bridge.
Authentication and identity
Organizational access should be tied to an individual user or device identity. IEEE 802.1X permits EAP method selection and centralized access decisions through an AAA server.
Certificate methods reduce password-disclosure risk but require certificate lifecycle management. Tunneled methods require correct trusted-authority and server-name configuration. A client that accepts every certificate cannot distinguish hostile infrastructure.
Segmentation and policy enforcement
Successful authentication should not grant access to the whole network. Employee, guest, administrative, and IoT clients need separate segments and policies.
- A RADIUS response can drive dynamic VLAN or policy assignment.
- Client isolation limits direct station-to-station communication in one SSID.
- Firewall rules restrict access to internal and management services.
- NAC can evaluate device posture before granting broader access.
Radio and infrastructure monitoring
A WIDS can identify unknown access points, unusual channel changes, repeated authentication failures, and frequent disconnection frames. WIPS response functions must comply with local law and avoid interference with third-party networks.
Inventory should combine radio observations with switch attachment data. An SSID alone does not show whether a transmitter belongs to the organization, a neighbor, or an attacker.
Availability and interference
Encryption does not prevent jamming. Interference can come from a deliberate transmitter, congested neighboring network, industrial equipment, or defective hardware. Diagnosis requires channel-utilization, noise-level, and retransmission measurements.
Channel planning, access-point placement, and capacity margin reduce ordinary interference. Availability incidents require detection, source location, and a procedure for moving critical service to alternative access.
Protection beyond Wi-Fi
TLS, SSH, and VPN protocols protect data after it leaves the access point. This is important on guest or public networks whose operator is not trusted. A VPN does not establish endpoint security or remove application vulnerabilities.
Audit scope
- Authentication mode, certificate validation, and password policy.
- Guest, IoT, employee, and administrative segmentation.
- Access-point and controller software versions.
- Management-interface protection and configuration backups.
- Event logging, time synchronization, and log retention.
- Radio coverage beyond controlled space and unknown transmitters.
WEP, WPA2, WPA3, SAE, and OWE are covered in the Wi-Fi security article. Infrastructure assessment evaluates those mechanisms together with the remaining protection layers.