Políticas Seguras de BYOD para Redes WiFi del Personal

Esta guía autorizada proporciona a los líderes de TI un marco independiente del proveedor para la incorporación segura de dispositivos personales del personal. Detalla las decisiones arquitectónicas críticas —incluyendo la segmentación de red, la autenticación EAP-TLS y la integración de MDM— necesarias para soportar BYOD sin comprometer la infraestructura corporativa central.

📖 6 min de lectura📝 1,258 palabras🔧 2 ejemplos prácticos❓ 3 preguntas de práctica📚 8 definiciones clave

Escuchar esta guía

Ver transcripción del podcast

PODCAST SCRIPT: Secure BYOD Policies for Staff WiFi Networks
Runtime target: ~10 minutes | Voice: UK English, male, senior consultant tone
Purple WiFi Intelligence Platform — Staff WiFi Series

---

[INTRO & CONTEXT — ~1 minute]

Welcome to the Purple Staff WiFi Series. I'm your host, and today we're getting into one of the most consistently mishandled areas in enterprise network management: BYOD — Bring Your Own Device — specifically for staff WiFi.

If you're an IT director, a network architect, or a CTO at a hotel group, a retail chain, a stadium, or a public-sector organisation, this episode is built for you. We're not going to cover the basics of what WiFi is. We're going to talk about the architecture decisions, the standards you need to reference, and the deployment mistakes that cost organisations real money and real compliance exposure.

The core problem is straightforward: your staff want to use their personal phones and tablets for work. That's reasonable. But plugging unmanaged personal devices into the same network segment as your POS systems, your HR databases, or your payment infrastructure is an unacceptable risk. The question isn't whether to allow BYOD — it's how to allow it without compromising your core network. Let's get into it.

---

[TECHNICAL DEEP-DIVE — ~5 minutes]

Let's start with the foundational principle: network segmentation. Every secure BYOD deployment begins with the same architectural decision — you do not put personal devices on the same VLAN as your corporate infrastructure. Full stop.

The standard approach is a dedicated BYOD VLAN, sitting between your corporate core and your guest WiFi network. Think of it as a middle tier. Staff devices get internet access and access to a defined set of approved internal resources — perhaps your intranet, your cloud productivity suite, your internal comms platform — but they are firewalled away from your payment systems, your back-office servers, and your core switching infrastructure.

Now, how do you authenticate devices onto that BYOD VLAN? The answer is IEEE 802.1X. This is the port-based network access control standard, and it's been the backbone of enterprise wireless authentication for over two decades. When a device attempts to connect, 802.1X triggers an EAP exchange — Extensible Authentication Protocol — between the device, the wireless access point acting as an authenticator, and your RADIUS server as the authentication backend.

For BYOD specifically, EAP-TLS is the gold standard. That's certificate-based mutual authentication. The device presents a certificate, the RADIUS server validates it, and only then is network access granted. The certificate is provisioned to the device via your MDM platform — Microsoft Intune, Jamf, VMware Workspace ONE, whatever you're running — using SCEP, the Simple Certificate Enrollment Protocol.

Why certificates over passwords? Because passwords get shared, phished, and forgotten. A certificate tied to a specific device and a specific user identity is significantly harder to compromise. And critically, when an employee leaves, you revoke the certificate in your PKI, and that device loses access immediately — no password reset required, no lingering credentials.

Now, on the encryption side: if you're deploying new infrastructure in 2024 and beyond, WPA3-Enterprise is your target. WPA3 eliminates the KRACK vulnerability that plagued WPA2, mandates 192-bit security mode for enterprise deployments, and provides forward secrecy via SAE — Simultaneous Authentication of Equals. That means even if a session key is compromised, historical traffic cannot be decrypted. For environments handling payment card data or patient records, this isn't optional — it's a compliance requirement under PCI DSS 4.0 and increasingly referenced in NHS Digital security frameworks.

Let's talk about MDM integration, because this is where a lot of deployments fall short. Your MDM is not just a certificate delivery mechanism — it's your compliance enforcement engine. Before a device is granted access to the BYOD VLAN, your NAC solution should be querying the MDM for device posture: Is the OS patched to a minimum version? Is device encryption enabled? Is the device jailbroken or rooted? Is a compliant screen lock configured?

This is called posture assessment, and it's the difference between a BYOD policy and a BYOD security programme. A device that fails posture assessment should be quarantined — placed on a remediation VLAN with access only to the resources needed to bring it into compliance, and nothing else.

On the logging and audit side: every device connecting to your BYOD VLAN should generate a session record — device identity, user identity, timestamp, duration, bytes transferred, and the VLAN assigned. This isn't just good practice; under GDPR Article 32, you have an obligation to implement appropriate technical measures to ensure network security. An audit trail of staff device connections is a core component of demonstrating that obligation. If you want to go deeper on audit trail requirements, Purple has a dedicated guide on what an audit trail means for IT security in 2026 — I'll link that in the show notes.

One more architectural point worth flagging: MAC address randomisation. Modern iOS and Android devices randomise their MAC addresses by default when probing for networks. This breaks MAC-based authentication and can cause issues with your RADIUS accounting. The solution is to move away from MAC-based auth entirely — which you should be doing anyway — and rely on certificate or credential-based identity. Your RADIUS server should be keying session records to user identity, not device hardware address.

---

[IMPLEMENTATION RECOMMENDATIONS & PITFALLS — ~2 minutes]

Right, let's talk deployment. Here's the sequence I recommend for any organisation rolling out a BYOD programme from scratch.

Step one: define your policy before you touch the infrastructure. Who is allowed to register a personal device? What device types are supported? What data can be accessed from a personal device? Get this signed off by HR, legal, and the CISO before you configure a single VLAN.

Step two: deploy your MDM if you haven't already, and configure SCEP certificate templates for BYOD devices. Test certificate enrollment on iOS, Android, and Windows — they all behave slightly differently.

Step three: configure your RADIUS server with separate policies for BYOD versus corporate-managed devices. BYOD devices should receive a VLAN assignment attribute — Tunnel-Private-Group-ID in RADIUS terms — that places them on the BYOD VLAN.

Step four: configure your wireless infrastructure. Create a dedicated SSID for BYOD, or use dynamic VLAN assignment on your existing corporate SSID — the latter is cleaner from a user experience perspective. Staff see one SSID, but the RADIUS server determines which VLAN they land on based on their certificate.

Step five: implement firewall ACLs between the BYOD VLAN and your corporate core. Default deny, with explicit permits only for approved services. Document every permit rule and review it quarterly.

Step six: enable session logging and integrate with your SIEM. Every BYOD connection event should be an alert-eligible record.

Now, the pitfalls. The most common failure I see is scope creep on the BYOD VLAN firewall rules. Someone needs temporary access to a resource, a rule gets added, and six months later the BYOD VLAN has effectively the same access as the corporate network. Implement a change management process for BYOD firewall rules and treat them with the same rigour as production infrastructure changes.

The second pitfall is certificate lifecycle management. Certificates expire. If you don't have automated renewal configured in your MDM, you will get a wave of staff unable to connect on the day their certificates expire. Set renewal to trigger at 30 days before expiry, minimum.

The third pitfall is forgetting about the guest network. Your BYOD VLAN and your guest WiFi network should be completely isolated from each other. A visitor on your guest network should have no path to your BYOD segment. If you're running Purple's guest WiFi platform, that isolation is handled at the infrastructure level — but verify it in your firewall policy regardless.

---

[RAPID-FIRE Q&A — ~1 minute]

Let me run through a few questions I hear regularly.

"Can we use WPA2-Personal with a shared passphrase for BYOD?" No. A shared passphrase provides zero per-device accountability, cannot be revoked per user, and is trivially compromised. Use 802.1X.

"Do we need a separate SSID for BYOD?" Not necessarily. Dynamic VLAN assignment via RADIUS is cleaner. One SSID, policy-driven VLAN placement based on certificate identity.

"What about contractors and temporary staff?" Treat them as a separate identity class in your RADIUS policy. Issue short-lived certificates — 30 or 90 days — tied to their contract duration. When the contract ends, the certificate expires.

"Is WPA3 backwards compatible?" Yes, in transition mode. Your access points can support both WPA2 and WPA3 clients simultaneously. Mandate WPA3-only for new device enrolments and phase out WPA2 over a defined timeline.

---

[SUMMARY & NEXT STEPS — ~1 minute]

To wrap up: a secure BYOD programme for staff WiFi is not a single configuration task — it's an architecture decision, a policy framework, and an ongoing operational discipline.

The non-negotiables are: dedicated BYOD VLAN, IEEE 802.1X with EAP-TLS certificate authentication, MDM-enforced device posture, WPA3-Enterprise encryption, and comprehensive audit logging.

The operational disciplines are: certificate lifecycle management, quarterly firewall rule reviews, and a defined offboarding process that revokes device certificates on the day an employee leaves.

If you're starting from scratch, the Purple platform gives you the analytics and access management layer on top of your existing wireless infrastructure — whether you're running a single hotel property or a 200-site retail estate.

Links to the architecture guide, the audit trail reference, and the BYOD onboarding checklist are all in the show notes. Thanks for listening — we'll see you in the next episode.

---
END OF SCRIPT

Resumen Ejecutivo

El entorno empresarial moderno exige flexibilidad, y la expectativa del personal de acceso Bring Your Own Device (BYOD) ya no es negociable. Sin embargo, la integración de dispositivos personales no gestionados en las redes inalámbricas corporativas introduce riesgos significativos de seguridad y cumplimiento. Esta guía de referencia técnica proporciona a los arquitectos de red y directores de TI un marco robusto para implementar políticas seguras de BYOD para redes WiFi del personal. Describimos las decisiones arquitectónicas críticas, centrándonos en la segmentación de red, la autenticación IEEE 802.1X y la integración de Mobile Device Management (MDM). Al pasar de las contraseñas compartidas y la autenticación basada en MAC a la identidad basada en certificados (EAP-TLS) y el cifrado WPA3-Enterprise, las organizaciones pueden proporcionar conectividad sin interrupciones sin comprometer su infraestructura central. Ya sea que opere en Retail , Healthcare , Hospitality o Transport , esta guía ofrece las mejores prácticas neutrales al proveedor necesarias para asegurar el borde de su red mientras apoya la productividad del personal.

Escuche nuestro podcast complementario para un resumen ejecutivo sobre estos conceptos:

Análisis Técnico Detallado

Arquitectura de Red y Segmentación

El principio fundamental de cualquier implementación segura de BYOD es una segmentación de red rigurosa. Los dispositivos personales nunca deben residir en la misma Virtual Local Area Network (VLAN) que la infraestructura corporativa, los sistemas de punto de venta (POS) o las bases de datos sensibles. Una VLAN BYOD dedicada actúa como una capa intermedia segura, lógicamente aislada tanto del núcleo corporativo como de la red Guest WiFi .

Esta segmentación asegura que, incluso si el dispositivo personal de un miembro del personal se ve comprometido, la amenaza queda contenida. El acceso desde la VLAN BYOD a los recursos corporativos internos debe regirse por estrictas Listas de Control de Acceso (ACL) del firewall, operando bajo un principio de denegación por defecto con permisos explícitos solo para los servicios requeridos (por ejemplo, portales de intranet o aplicaciones específicas en la nube).

Autenticación: El Estándar IEEE 802.1X

Asegurar el perímetro BYOD requiere una autenticación robusta. El estándar IEEE 802.1X proporciona control de acceso a la red basado en puertos, asegurando que los dispositivos sean autenticados antes de obtener acceso a la capa de red. Dentro del marco 802.1X, el Extensible Authentication Protocol with Transport Layer Security (EAP-TLS) es el estándar de oro para entornos BYOD.

EAP-TLS se basa en la autenticación mutua basada en certificados. En lugar de contraseñas vulnerables, el dispositivo presenta un certificado digital emitido por la Infraestructura de Clave Pública (PKI) de la organización. El servidor RADIUS valida este certificado, asegurando que tanto el dispositivo como la identidad del usuario sean verificados. Este enfoque mitiga los riesgos asociados con el robo de credenciales, el phishing y la sobrecarga operativa de los restablecimientos de contraseña.

Cifrado y Cumplimiento

Los datos en tránsito deben protegerse contra la interceptación. WPA3-Enterprise es el estándar actual para asegurar el tráfico inalámbrico, reemplazando a WPA2 al eliminar vulnerabilidades como el ataque KRACK. WPA3-Enterprise exige el modo de seguridad de 192 bits para entornos altamente sensibles y proporciona secreto hacia adelante a través de Simultaneous Authentication of Equals (SAE). La implementación de WPA3-Enterprise es cada vez más un requisito obligatorio para los marcos de cumplimiento, incluyendo PCI DSS 4.0 y varios estándares de protección de datos sanitarios.

Además, el cumplimiento requiere una visibilidad integral. Cada evento de conexión en la red BYOD debe registrarse, capturando la identidad del dispositivo, la identidad del usuario, la marca de tiempo y la asignación de VLAN. Esta pista de auditoría es fundamental para demostrar el cumplimiento de regulaciones como el Artículo 32 de GDPR. Para más contexto sobre los requisitos de registro, consulte nuestra guía sobre Explain what is audit trail for IT Security in 2026 .

Guía de Implementación

La implementación de una red BYOD segura requiere coordinación entre la política, la gestión de identidades y la infraestructura de red.

Implementación Paso a Paso

Definición de Políticas: Antes de modificar la infraestructura, defina la política BYOD. Determine los grupos de usuarios elegibles, los tipos de dispositivos aprobados y los recursos corporativos específicos accesibles desde la VLAN BYOD. Obtenga la aprobación de los líderes legales, de RRHH y de seguridad.
Integración de MDM y Aprovisionamiento de Certificados: Aproveche su plataforma de Mobile Device Management (MDM) (por ejemplo, Intune, Jamf) para aprovisionar certificados EAP-TLS a los dispositivos del personal. Utilice el Simple Certificate Enrollment Protocol (SCEP) para automatizar esta entrega. El MDM también sirve como motor de aplicación para las comprobaciones de postura del dispositivo (por ejemplo, verificar los niveles de parche del sistema operativo y el estado de cifrado) antes de que se conceda el acceso a la red.
Configuración de RADIUS: Configure el servidor RADIUS con políticas específicas para dispositivos BYOD. Cuando un dispositivo BYOD se autentica correctamente a través de su certificado, el servidor RADIUS debe devolver un atributo de asignación dinámica de VLAN (por ejemplo, Tunnel-Private-Group-ID) para colocar el dispositivo en la VLAN BYOD aislada.
Configuración de la Infraestructura Inalámbrica: Implemente la asignación dinámica de VLAN en su Service Set Identifier (SSID) corporativo existente. Esto proporciona una experiencia de usuario fluida: el personal "se conectan a una red, y la infraestructura los dirige a la VLAN adecuada según su identidad autenticada.
Firewall y Control de Acceso: Aplique ACLs estrictas en el límite entre la VLAN BYOD y el núcleo corporativo. Documente cada regla de permiso y establezca un proceso de revisión trimestral para evitar la expansión del alcance.
Monitorización y Análisis: Integre los registros de conexión BYOD con su sistema de Gestión de Información y Eventos de Seguridad (SIEM). Utilice plataformas como WiFi Analytics para monitorizar el rendimiento de la red, la distribución de dispositivos y posibles anomalías.

Mejores Prácticas

Abandonar la Autenticación Basada en MAC: Los sistemas operativos móviles modernos (iOS, Android) aleatorizan las direcciones MAC para proteger la privacidad del usuario. Esto rompe la autenticación y el seguimiento tradicionales basados en MAC. Confíe exclusivamente en la identidad basada en certificados (EAP-TLS) vinculada al usuario, no a la dirección de hardware.
Imponer Evaluación de Postura: Una política BYOD está incompleta sin comprobaciones de postura. Asegúrese de que su solución de Control de Acceso a la Red (NAC) consulte al MDM para verificar que los dispositivos cumplen con las líneas de base de seguridad mínimas (por ejemplo, no están rooteados/jailbroken, bloqueo de pantalla activado) antes de conceder acceso. Los dispositivos no conformes deben ser dirigidos a una VLAN de remediación.
Automatizar la Gestión del Ciclo de Vida de los Certificados: Los certificados caducan. Configure su MDM para renovar automáticamente los certificados mucho antes de su caducidad (por ejemplo, 30 días antes) para evitar fallos masivos de conectividad. Además, integre la revocación de certificados con su proceso de desvinculación de RRHH para terminar el acceso inmediatamente cuando un empleado se va.
Mantener un Aislamiento Estricto: Asegure un aislamiento absoluto entre la VLAN BYOD y la red de invitados. Un dispositivo comprometido en la red de invitados no debe tener ninguna ruta de movimiento lateral hacia los dispositivos del personal. Para solucionar problemas de acceso de invitados, consulte Resolviendo el error "Conectado pero sin Internet" en WiFi de Invitados .

Resolución de Problemas y Mitigación de Riesgos

Expansión del Alcance de las Reglas del Firewall: El modo de fallo más común en las implementaciones BYOD es la erosión gradual de la segmentación de la red. Las reglas de acceso temporales se vuelven permanentes, fusionando efectivamente las redes BYOD y corporativas. Mitigación: Implemente un proceso riguroso de gestión de cambios para las reglas del firewall BYOD y realice revisiones trimestrales obligatorias.
Interrupciones por Caducidad de Certificados: La falta de gestión de los ciclos de vida de los certificados provoca caídas repentinas de conectividad para grandes grupos de personal. Mitigación: Implemente la renovación automatizada a través de SCEP/MDM y configure alertas proactivas para las caducidades inminentes.
Desvinculación Incompleta: El acceso persistente para antiguos empleados es una vulnerabilidad de seguridad crítica. Mitigación: Automatice la revocación del certificado del usuario en la PKI en el momento en que su estado cambie en el sistema de RRHH.

ROI e Impacto Empresarial

La implementación de una arquitectura BYOD segura requiere una inversión inicial en infraestructura NAC, MDM y RADIUS. Sin embargo, el retorno de la inversión (ROI) es sustancial:

Mitigación de Riesgos: Al aislar los dispositivos no gestionados, la organización reduce drásticamente la superficie de ataque para el ransomware y el movimiento lateral, protegiendo los activos críticos y evitando costosas filtraciones de datos.
Eficiencia Operativa: La autenticación basada en certificados elimina la sobrecarga del servicio de asistencia de TI asociada con los restablecimientos de contraseña y la gestión de credenciales compartidas.
Productividad del Personal: Proporcionar acceso seguro y sin interrupciones a los recursos necesarios en dispositivos personales mejora la satisfacción y la productividad del personal, particularmente en entornos dinámicos como plantas de venta minorista o salas de hospital.
Garantía de Cumplimiento: El registro de auditoría completo y el cifrado robusto aseguran que la organización cumpla con los requisitos regulatorios, evitando posibles multas y daños a la reputación.

A medida que las organizaciones expanden su huella digital, la conectividad segura sigue siendo primordial. Iniciativas como la integración de ciudades inteligentes, impulsadas por líderes de la industria (véase Purple nombra a Iain Fox como VP de Crecimiento – Sector Público para Impulsar la Inclusión Digital y la Innovación en Ciudades Inteligentes ), dependen de arquitecturas de seguridad fundamentales robustas. Además, garantizar una navegación fluida dentro de grandes recintos, apoyada por características como Purple lanza el modo de mapas sin conexión para una navegación fluida y segura a los puntos de acceso WiFi , depende de una infraestructura de red subyacente fiable y segura.

Definiciones clave

IEEE 802.1X

An IEEE standard for port-based Network Access Control (PNAC). It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

The foundational protocol used to authenticate staff devices before they are allowed onto the BYOD network.

EAP-TLS (Extensible Authentication Protocol-Transport Layer Security)

An EAP method that relies on client and server certificates to establish a secure mutual authentication tunnel.

Considered the most secure authentication method for BYOD, as it eliminates the reliance on vulnerable user passwords.

RADIUS (Remote Authentication Dial-In User Service)

A networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect and use a network service.

The backend server that evaluates the 802.1X requests from access points and decides whether to grant a device access to the network.

Dynamic VLAN Assignment

A network configuration where the RADIUS server dictates which VLAN a user or device should be placed in upon successful authentication, rather than hardcoding the VLAN to the SSID.

Allows organizations to broadcast a single SSID while securely separating traffic (e.g., corporate vs. BYOD) based on the user's identity.

MAC Address Randomization

A privacy feature in modern mobile OSs where the device uses a randomly generated MAC address instead of its true hardware address when scanning for or connecting to networks.

This feature renders legacy MAC-based authentication methods obsolete, forcing a shift to identity-based authentication like 802.1X.

MDM (Mobile Device Management)

Software that allows IT administrators to control, secure, and enforce policies on smartphones, tablets, and other endpoints.

Used in BYOD deployments to push network certificates to devices and verify their security posture (e.g., patch level) before allowing network access.

WPA3-Enterprise

The latest generation of Wi-Fi security, providing robust encryption and requiring 802.1X authentication for enterprise networks.

Mandatory for modern secure deployments to protect data in transit against advanced cryptographic attacks.

Posture Assessment

The process of evaluating a device's security state (e.g., OS version, antivirus status, encryption) before granting it network access.

Ensures that a staff member's personal device isn't harboring malware or running an outdated OS before it connects to the BYOD VLAN.

Ejemplos prácticos

A 400-bed hospital needs to allow nursing staff to use personal smartphones to access a secure internal scheduling application, but these devices must be strictly isolated from the clinical network containing patient records (EHR) and medical devices.

The hospital implements a dedicated BYOD VLAN. They deploy an MDM solution to push EAP-TLS certificates to staff smartphones. The wireless infrastructure uses 802.1X authentication; when a nurse connects, the RADIUS server validates the certificate and assigns the device to the BYOD VLAN. A firewall sits between the BYOD VLAN and the clinical network, with a strict default-deny policy. A single explicit permit rule allows HTTPS traffic from the BYOD VLAN to the specific IP address of the scheduling application server.

Comentario del examinador: This approach effectively balances access and security. By using EAP-TLS, the hospital avoids the risks of shared passwords. Dynamic VLAN assignment ensures staff are placed in the correct security zone automatically. The strict firewall ACL ensures that even if a personal device is compromised, it cannot scan or attack the sensitive clinical network.

A national retail chain with 150 stores wants store managers to access inventory dashboards on their personal tablets. The chain currently uses WPA2-Personal with a shared password for staff WiFi, which is frequently shared with non-managers.

The retailer phases out the shared password SSID. They implement a centralized RADIUS server and integrate it with their Azure AD. They use their MDM to deploy certificates to approved manager tablets. The stores broadcast a single corporate SSID. Managers authenticate via 802.1X (EAP-TLS) and are dynamically assigned to a 'Manager BYOD' VLAN, which has firewall rules permitting access to the centralized inventory dashboard. Non-managers without certificates cannot connect.

Comentario del examinador: This scenario highlights the transition from insecure legacy practices to enterprise-grade security. Removing the shared passphrase eliminates unauthorized access. Centralized RADIUS allows for consistent policy enforcement across all 150 locations, and dynamic VLAN assignment simplifies the RF environment by reducing the number of broadcast SSIDs.

Preguntas de práctica

Q1. Your organization is rolling out a BYOD program. The network team proposes using WPA2-Personal with a complex, rotating pre-shared key (PSK) that changes monthly, arguing it is simpler to deploy than 802.1X. As the IT Director, how should you respond?

Sugerencia: Consider the requirements for individual accountability and the operational overhead of offboarding an employee mid-month.

Ver respuesta modelo

Reject the proposal. A PSK, even a rotating one, provides no per-device or per-user accountability. If an employee leaves mid-month, the key must be changed immediately, disrupting all other users. You must mandate IEEE 802.1X (preferably EAP-TLS) to ensure individual authentication, enabling immediate, targeted revocation of access without affecting the rest of the staff.

Q2. A staff member reports they cannot connect their new personal iPhone to the BYOD network. Your RADIUS logs show authentication failures, but the user insists they have the correct profile installed. The logs indicate the device is presenting a different MAC address on each connection attempt. What is the root cause and the architectural fix?

Sugerencia: Modern mobile operating systems implement privacy features that affect layer 2 identification.

Ver respuesta modelo

The root cause is MAC address randomization, a default privacy feature in modern iOS and Android devices. The architectural fix is to completely decouple authentication and policy enforcement from MAC addresses. The network must rely solely on the cryptographic identity provided by the EAP-TLS certificate for authentication and subsequent session tracking.

Q3. During a security audit, the auditor notes that the BYOD VLAN has a firewall rule permitting all traffic (Any/Any) to the corporate subnet housing the HR database, citing a temporary requirement from six months ago that was never removed. What process failure occurred, and how is it remediated?

Sugerencia: Focus on the lifecycle of firewall rules and the principle of least privilege.

Ver respuesta modelo

The failure is 'firewall rule scope creep' and a lack of lifecycle management for access controls. The remediation is two-fold: First, immediately remove the Any/Any rule and replace it with an explicit permit only for the required ports/protocols (if access is still needed). Second, implement a mandatory quarterly review process for all ACLs governing traffic between the BYOD VLAN and the corporate core to ensure temporary rules are purged.