14.3 Secure Wireless Communications
Key Takeaways
- SSCP Knowledge Area 6.6 covers cellular, Wi-Fi, Bluetooth, and Near-Field Communication (NFC), plus authentication and encryption protocols: WPA, EAP, WPA2, and WPA3.
- Wired Equivalent Privacy (WEP) is obsolete. Original WPA with Temporal Key Integrity Protocol (TKIP) is deprecated. Do not bring them back for 'compatibility.'
- WPA3-Personal uses Simultaneous Authentication of Equals (SAE) instead of a WPA2 pre-shared key four-way handshake, adding forward secrecy and resistance to offline dictionary attacks against a captured handshake.
- Corporate access should use WPA3-Enterprise (or WPA2-Enterprise) with 802.1X and Extensible Authentication Protocol, not a guest WPA2-PSK written on a whiteboard.
- An evil twin is a rogue access point that mimics a trusted SSID. KRACK is a key-reinstallation attack against the WPA2 handshake — patch clients and access points; WPA3 SAE is the protocol-level successor for personal mode.
Secure wireless communications as a Domain 6 operations topic
Knowledge Area 6.6 — Secure wireless communications — names two piles: technologies (cellular network, Wi-Fi, Bluetooth, Near-Field Communication (NFC)) and authentication and encryption protocols (Wi-Fi Protected Access (WPA), Extensible Authentication Protocol (EAP), Wi-Fi Protected Access 2 (WPA2), Wi-Fi Protected Access 3 (WPA3)). Domain 6 is still 16% of the SSCP. Wireless items fail people who can recite AES-CCMP but put the EHR laptop on the guest pre-shared key.
Wireless is a network you do not fully own the physical layer of. Anyone in the parking lot can receive frames. Anyone with a travel router can transmit frames that look like yours. Encryption and authentication are how you make that radio path no weaker than a wall jack with 802.1X.
Technologies: cellular, Wi-Fi, Bluetooth, and NFC
| Technology | Typical range / use | What the SSCP actually administers | Failure mode |
|---|---|---|---|
| Cellular (LTE / 5G) | Wide area; phones, tablets, failover routers, some medical carts | Mobile device management (MDM) data policies, private Access Point Name (APN) or VPN for PHI, disable tethering if policy says so | IMSI catchers / rogue base stations; split-tunnel cellular that bypasses the campus CASB; an unattended failover router with a default admin page |
| Wi-Fi (IEEE 802.11) | Campus LAN without cables | SSID design, encryption/auth, rogue detection, guest isolation, Protected Management Frames (PMF) | Open or WEP SSIDs, evil twins, overlapping guest/corporate, KRACK-unpatched handshake |
| Bluetooth (including Bluetooth Low Energy (BLE)) | Personal area: headsets, keyboards, badges, infusion-pump pairing | Disable when unused, controlled pairing, inventory of BLE medical/OT gear | Bluejacking (unsolicited messages), Bluesnarfing (unauthorized data pull on misconfigured stacks), headset that is also a microphone next to a nurse station |
| NFC | Centimeters: badges, payments, device bootstrap, some physical access | Short-range does not mean "no crypto needed"; control what the badge unlocks | Relay/eavesdrop at checkout; a phone wallet that provisions access tokens; NFC used to join Wi-Fi without showing the user the SSID's auth |
Cellular is easy to forget because there is no campus SSID. A clinic crash-cart tablet on LTE that uploads images without a virtual private network (VPN) or private APN is an egress path around every 6.5 appliance you racked. 5G private campus networks exist; they still need SIM/identity control and segmentation. Do not treat "it is the carrier's network" as a BAA or a firewall.
Wi-Fi is the bulk of 6.6. Separate service set identifiers (SSIDs) for corporate, guest, voice, and IoT. Guest gets client isolation (no peer-to-peer on the AP) and no route to EHR VLANs (6.4/6.7). Corporate gets Enterprise authentication. Disable older 802.11 rates only when the installed base allows it; do not disable encryption to keep a badge printer alive — put the printer on a dedicated IoT SSID with its own controls.
Bluetooth is a pairing problem more than a SSID problem. Require user confirmation, turn it off on servers and kiosks that do not need it, and watch medical BLE: a pump that pairs to the first phone in range is an IoT issue you will meet again in 6.7. NFC is even shorter range, which attackers solve with a relay or by standing in the checkout line. For SSCP, NFC is not "unhackable because it is close." It is a channel that still needs the same questions: what identity is presented, what is encrypted, what can it authorize.
Scenario — cellular bypass. A provider's personal phone hotspots the EHR workstation when "Wi-Fi is slow." The session to the cloud EHR now rides consumer LTE, skipping the campus proxy, CASB, and DLP. The wireless problem is not the campus SSID. It is an unmanaged cellular path. MDM, hotspot policy, and (if the EHR is web-based) conditional access that dislikes unmanaged networks are the operations answer.
Authentication and encryption protocols: WEP through WPA3, and EAP
The outline lists WPA, EAP, WPA2, and WPA3. You still must know Wired Equivalent Privacy (WEP) because stems offer it.
| Protocol | Crypto / handshake | Status for SSCP operations | Use it when |
|---|---|---|---|
| WEP | RC4 with a reused/weak IV; cracked in minutes with enough IVs | Obsolete. Never "WEP-256 for compatibility" | Never. Retire the client or isolate it off wireless |
| WPA (original) | Temporal Key Integrity Protocol (TKIP) on the way out of WEP | Deprecated. TKIP is broken for current use | Migration museum only |
| WPA2-Personal | AES-CCMP, shared passphrase, four-way handshake | Acceptable for guest/home-like SSIDs with a rotated key and isolation | Guest, printers you cannot 802.1X — not EHR laptops |
| WPA2-Enterprise | AES-CCMP plus 802.1X/EAP per user or device | Current corporate baseline still widely deployed | Corporate SSID until WPA3-Enterprise is fully rolled out |
| WPA3-Personal | Simultaneous Authentication of Equals (SAE) (Dragonfly); forward secrecy; PMF required | Current personal-mode replacement for the PSK handshake | Guest/small office where you cannot run RADIUS, and you want offline-dictionary resistance |
| WPA3-Enterprise | 802.1X/EAP; optional 192-bit suite (GCMP-256) in CNSA-style modes; PMF | Preferred corporate | EHR, finance, admin laptops |
WEP is obsolete. If a vendor still requires it, that is an EOL conversation (6.7), not a wireless "mode." TKIP was a patch on WEP and is not a 2026 corporate cipher.
WPA2-Personal uses a pre-shared key (PSK). Everyone with the passphrase can decrypt traffic that used that PSK (with caveats) and can join. The four-way handshake, if captured, is food for offline dictionary attacks against a weak passphrase. Key Reinstallation Attack (KRACK) (2017) abused handshake retransmission so a victim could reinstall an already-used key, weakening encryption. KRACK is conceptual on the SSCP: it is not a reason to claim "WPA2 is equivalent to WEP," and it is not a Bluetooth bug. The operations response was patch access points and clients, disable vulnerable handshake patterns where vendors said so, and move personal SSIDs to WPA3 SAE, which was designed so that handshake capture does not yield the same offline PSK crack and so that keys are not reinstalled the same way.
WPA3-Personal SAE is a password-authenticated key exchange. Each side proves knowledge of the password without putting a crackable handshake on the air the way WPA2-PSK did. It provides forward secrecy: stealing today's passphrase does not decrypt yesterday's captured frames. Transition mode (WPA2+WPA3 on one SSID) exists so old clients can join; it also keeps WPA2-PSK attack surface on that SSID. Prefer a clean WPA3 SSID when the client fleet allows it.
Enterprise mode (WPA2 or WPA3) uses IEEE 802.1X and EAP against a RADIUS server (6.3). Each user or machine has an identity. You can revoke one without reprinting a wall sign. The access point becomes the authenticator; the RADIUS server is the authentication server; the supplicant is the laptop.
| EAP method | How it authenticates | SSCP note |
|---|---|---|
| EAP-TLS | Client and server certificates | Strongest common choice; requires a device PKI |
| PEAP (often MSCHAPv2 inside) | Server cert; user password inside a TLS tunnel | Very common. Protect the inner method; still phishing-vulnerable if users ignore cert warnings |
| EAP-TTLS | Similar tunnel; inner PAP/MSCHAPv2/etc. | Same operational story as PEAP |
| EAP-FAST | Cisco PAC-based tunnel | Know it exists; not the default answer over EAP-TLS |
| LEAP | Old Cisco, weak | Do not use |
Validate the RADIUS server certificate on the client (or use EAP-TLS both ways) or an evil twin plus a hostile RADIUS will collect passwords.
Protected Management Frames (IEEE 802.11w), mandatory in WPA3, stop some deauth floods that kicked users onto a rogue AP. They are not a complete evil-twin defense.
Evil twins, guest PSK, and the corporate SSID
An evil twin is a rogue access point (or a laptop in AP mode) that advertises a trusted SSID — Clinic-WiFi, Hospital-Guest — often with a louder signal and a captive portal that asks for the directory password. Open and PSK networks make this easy: the attacker does not need your RADIUS. Enterprise 802.1X makes it harder because the client should authenticate the network (server certificate). Users who click through certificate warnings donate credentials anyway. Operations: wireless intrusion prevention to detect rogue BSSIDs, user training that campus Wi-Fi does not suddenly sprout a hotel-style portal, and never put EHR workstations on the guest PSK.
Scenario — WPA2-PSK guest versus WPA3-Enterprise. Reception prints Guest-WiFi / Summer2026! on a whiteboard. Clinicians join it with EHR laptops "because it is faster." A visitor captures the handshake, cracks the weak seasonal passphrase, and sits in the waiting room on the same Layer 2 segment. If guest isolation and firewall zones were skipped, that visitor is adjacent to clinical traffic. The SSCP design is: corporate SSID = WPA3-Enterprise (or WPA2-Enterprise during rollout) with EAP-TLS or PEAP and a validated server cert; guest SSID = isolated VLAN, no route to EHR, client isolation, a rotated passphrase or a captive portal that does not collect AD passwords, preferably WPA3-Personal SAE if devices support it. Do not reuse the guest PSK on the corporate SSID "so people only memorize one key." Do not disable encryption so NAC can "see usernames."
Exam traps for 6.6
- WEP or TKIP as a compatibility feature.
- Calling WPA2-PSK "Enterprise" because the passphrase is long.
- Claiming KRACK means all WPA2 is as dead as WEP — unpatched handshake reuse is the issue; patching plus WPA3 SAE is the path.
- Treating NFC or Bluetooth as out of scope because they are short range.
- Trusting a captive portal on a familiar SSID name.
When you sit the item, ask: which radio, which identity (PSK vs 802.1X vs SAE), and can the client authenticate the infrastructure?
A small clinic cannot run RADIUS for a visitor SSID and currently uses a static passphrase. Which personal-mode protocol is the current replacement for WEP and for original WPA with TKIP?
Reception posts a WPA2-PSK passphrase for Hospital-Guest on a whiteboard. Clinicians put electronic health record laptops on that SSID because it is convenient. What should the SSCP implement?
A staff member at a cafe joins an access point named Clinic-WiFi. A captive portal asks for their Active Directory password. What is the attack, and what is the protocol-level defense on campus?