WPA-PSK Explicado: Qué Es, Cómo Funciona y Sus Riesgos de Seguridad

Esta referencia técnica autorizada desglosa la mecánica de WPA-PSK —su handshake de 4 vías, arquitectura criptográfica y vulnerabilidades de seguridad inherentes— y explica con precisión por qué las redes empresariales deben hacer la transición a arquitecturas robustas 802.1X o de Captive Portal gestionado. Proporciona una guía de implementación práctica para líderes de TI que gestionan entornos complejos en hostelería, comercio minorista, eventos y organizaciones del sector público.

📖 6 min de lectura📝 1,328 palabras🔧 2 ejemplos❓ 3 preguntas📚 9 términos clave

🎧 Escuchar esta guía

Ver transcripción

Welcome to the Purple Enterprise Networking Briefing. Today we are diving deep into a protocol that is likely running somewhere in your environment right now, perhaps where it shouldn't be: WPA-PSK. We're going to break down what it is, exactly how it works under the hood, and most importantly, why relying on it in an enterprise setting is a significant security and operational risk.

Let's start with the basics. WPA-PSK, or WiFi Protected Access Pre-Shared Key. It's the password we all use at home. But in a business context — say, a retail chain, a large hotel, or a conference centre — why is this consumer-grade standard still so prevalent?

It comes down to perceived simplicity. When a venue needs to get devices online quickly — whether it's point-of-sale terminals, handheld scanners, or even guest devices — typing in a single password feels like the path of least resistance. You don't need to stand up a RADIUS server, you don't need an Identity Provider. You just configure the Access Point, hand out the password, and you're done. But that simplicity is a trap. It's a massive operational debt disguised as a quick fix.

Let's get technical. How does WPA-PSK actually secure the connection? There's a common misconception that the password itself is encrypting the traffic. It isn't. The password — the PSK — is not the encryption key. It's the seed material. When you configure a PSK, the Access Point and the client device use that password, along with the network's SSID, to calculate what's called a Pairwise Master Key, or PMK. This is done using a hashing algorithm called PBKDF2, which runs the calculation four thousand and ninety-six times. This computational intensity was designed to slow down brute-force attacks. But the PMK still isn't used for data encryption.

So how do we get to the actual encryption? Through the 4-Way Handshake. This is the critical mechanism. The client and the AP need to prove to each other that they both know the PMK, but they can't transmit it over the air — that would be a massive security flaw. So, they exchange cryptographic nonces — basically random numbers. The AP sends a nonce, called the ANonce. The client sends a nonce back — the SNonce — along with a Message Integrity Code, or MIC. Using these nonces, both sides independently calculate the Pairwise Transient Key, the PTK. That PTK is what actually encrypts your session data. The AP then sends the Group Temporal Key — used for broadcast traffic — encrypted under the PTK, and the client acknowledges. Encrypted communication begins.

Now, the math here is solid. The AES encryption used in modern WPA is robust. So where does the security model break down for an enterprise?

The flaw isn't the encryption. It's the key management and the nature of the handshake. First, that 4-way handshake happens in the clear. If I'm an attacker sitting in your hotel lobby with a packet sniffer, I can capture that handshake. I don't even need to be connected to your network. Once I have the handshake, I take it offline. I use a powerful GPU rig to run a dictionary attack, rapidly guessing passwords, generating the PMK, and checking if it produces the same Message Integrity Code I captured. Because many venues use weak passwords — like the venue name and the year — I can crack it in minutes.

And what about deauthentication attacks? If no new devices are connecting, the attacker can't capture a handshake. So, they spoof a deauthentication frame, telling a legitimate client to disconnect. The client immediately reconnects, performs the 4-way handshake, and the attacker captures it. It's a noisy attack, but highly effective if you aren't monitoring for it with a Wireless Intrusion Detection System.

Now let's shift from the cryptographic risks to the operational realities. Because WPA-PSK creates two additional problems that are just as damaging as the security risk.

First: the identity vacuum. WPA-PSK authenticates the device, not the user. It tells you that a device with a specific MAC address knows the password. It doesn't tell you if that device belongs to your store manager, a guest, or an attacker. Without identity, you have no audit trail. If you are subject to PCI DSS for retail, or GDPR for any EU-facing operation, that lack of accountability is a major compliance failure. You cannot demonstrate who accessed what, when, and from where.

Second: the revocation nightmare. If a manager leaves, and they know the PSK for your corporate network, you have to change it. But changing the PSK means you now have to manually update every single legitimate device in that location — every scanner, every tablet, every POS terminal. In a retail chain with five hundred stores, that's potentially tens of thousands of devices. It's operationally unfeasible, so what usually happens? The password never gets changed. The security posture just degrades over time.

So what is the solution? How do enterprises move away from this?

You have to segment your approach based on the user type. For corporate assets — staff laptops, secure terminals, managed devices — you must migrate to WPA-Enterprise, or 802.1X. This requires users or devices to authenticate individually against a central directory, like Active Directory, using a RADIUS server and an EAP method such as EAP-TLS or PEAP. If a laptop is stolen or an employee leaves, you revoke their specific certificate or account. The rest of the network is completely untouched. There is no password to change.

For guest WiFi — obviously, we aren't putting hotel guests on 802.1X — handing out a PSK on a chalkboard is a missed opportunity. You transition to an Open network, but you secure the access layer using a Captive Portal. The user connects, they are redirected to a portal, and they authenticate via social login, email, or SMS. Now you know exactly who is on your network. You have an audit trail, you can enforce bandwidth limits per user, and crucially, you transform that WiFi from a cost centre into a marketing asset. You capture first-party data, you understand venue analytics, dwell times, return rates. None of that is possible with a shared PSK.

And what about legacy IoT devices? Sometimes you have an old HVAC sensor or a legacy payment terminal that only supports PSK. That's a reality we all face. If you must use PSK, containment is your strategy. You place those devices on a dedicated, heavily restricted VLAN. You implement strict client isolation so they can't communicate with each other, and you firewall them off from the corporate subnet. You treat that PSK network as hostile territory, because from a security standpoint, it is.

Let's talk about implementation priorities. If you are planning a migration this quarter, here is the recommended sequence. First, audit your current network. Identify every SSID, every authentication method, and every device type. Second, segment your SSIDs by user type: corporate staff, guests, and IoT. Third, deploy 802.1X for corporate devices. If you have a cloud-managed access point infrastructure, most modern vendors support RADIUS integration natively. Fourth, deploy a captive portal for guest access. Fifth, isolate any remaining PSK devices on a dedicated VLAN.

From a compliance perspective, this architecture directly addresses PCI DSS requirement 1.3 regarding network segmentation, requirement 8.2 regarding unique user identification, and GDPR Article 32 regarding appropriate technical security measures for personal data processing.

Now, a rapid-fire summary of the key takeaways.

One: PSK authenticates the device; Enterprise authenticates the user. If you need an audit trail, PSK is the wrong tool. Full stop.

Two: The 4-way handshake is public. If your password is weak, your network is compromised, regardless of the encryption algorithm. A complex, randomly generated passphrase is the minimum bar.

Three: Stop giving away guest WiFi with a shared password. Use a captive portal to secure the access and capture the analytics data your business needs. The return on investment is immediate.

Four: Legacy PSK devices must be isolated. Treat any PSK network segment as untrusted. VLAN isolation and client isolation are non-negotiable.

Five: WPA3 introduces Simultaneous Authentication of Equals, which provides protection against offline dictionary attacks even in PSK mode. If your hardware supports WPA3, enable it. But this does not address the identity or revocation problems — those require 802.1X or a captive portal.

To summarise: WPA-PSK was designed for a different era and a different scale. For any enterprise environment — whether you're operating a hotel chain, a retail estate, a stadium, or a public-sector facility — the combination of WPA-Enterprise for corporate devices and a managed captive portal for guests is the only architecture that delivers both security and business intelligence.

The next step is a network audit. Map every device, every SSID, and every authentication method in your estate. The findings will almost certainly reveal PSK deployments that need to be addressed urgently.

Thank you for listening to the Purple Enterprise Networking Briefing. For more technical guides, deployment frameworks, and case studies, visit purple.ai.

Conclusiones clave

✓WPA-PSK is designed for home networks; its reliance on a single shared key makes it operationally and cryptographically unsuitable for enterprise deployments.
✓The 4-way handshake is transmitted in the clear and is vulnerable to offline dictionary attacks — the strength of the PSK is the only defence.
✓PSK networks provide no user identity, making compliance with PCI DSS (Req. 8.2) and GDPR (Art. 32) extremely difficult to demonstrate.
✓Credential revocation in a PSK network requires changing the password on every AP and manually updating every client device — operationally unfeasible at scale.
✓Corporate assets must use WPA-Enterprise (802.1X) for per-user authentication, instant revocation, and a full audit trail.
✓Guest and public WiFi should use Open networks with managed Captive Portals to capture identity, enforce policies, and drive business analytics.
✓Legacy IoT devices requiring PSK must be strictly isolated on dedicated VLANs with client isolation and complex, regularly rotated passphrases.

Resumen Ejecutivo

Para los gerentes de TI y arquitectos de red que operan a gran escala —ya sea en cadenas minoristas, establecimientos de hostelería o grandes instalaciones del sector público— la seguridad WiFi no puede depender de mecanismos de consumo. WPA-PSK (WiFi Protected Access Pre-Shared Key) sigue siendo el estándar predeterminado para redes domésticas y pequeñas empresas, pero sus limitaciones arquitectónicas introducen riesgos inaceptables en entornos empresariales.

Aunque WPA-PSK es sencillo de implementar, depender de una única frase de contraseña compartida crea graves cuellos de botella operativos: la revocación de credenciales es imposible sin una interrupción de toda la red, la identidad del usuario sigue siendo opaca y la criptografía fundamental es vulnerable a ataques de diccionario offline. Esta guía analiza la mecánica técnica de WPA-PSK, explica exactamente dónde falla su modelo de seguridad para aplicaciones empresariales y describe el cambio imperativo hacia WPA-Enterprise (802.1X) y soluciones robustas de Guest WiFi .

Al comprender estas limitaciones, los CTOs y directores de operaciones de recintos pueden mitigar riesgos, asegurar el cumplimiento con estándares como PCI DSS y GDPR, y aprovechar plataformas como Purple para transformar una vulnerabilidad de seguridad en un activo gestionado y basado en análisis.

Análisis Técnico Detallado: Cómo Funciona WPA-PSK

WPA-PSK fue diseñado para proporcionar un cifrado fuerte sin la sobrecarga de un servidor de autenticación. Se basa en una Clave Pre-Compartida (PSK) —una contraseña que oscila entre 8 y 63 caracteres— que es conocida tanto por el dispositivo cliente (solicitante) como por el Punto de Acceso (autenticador).

La Base Criptográfica

La PSK no se utiliza directamente para cifrar el tráfico de datos. En su lugar, sirve como material semilla para generar una Clave Maestra Pareada (PMK). La PMK se calcula utilizando el algoritmo PBKDF2 (Password-Based Key Derivation Function 2), aplicando hash a la frase de contraseña junto con el SSID de la red 4.096 veces. Este proceso computacionalmente intensivo fue diseñado para ralentizar los ataques de fuerza bruta. Sin embargo, las plataformas GPU modernas pueden realizar miles de millones de operaciones de hash por segundo, lo que hace que esta protección sea inadecuada contra un atacante determinado con un handshake capturado.

El Handshake de 4 Vías

Una vez establecida la PMK, el cliente y el AP deben demostrar que ambos conocen la PMK sin transmitirla nunca por el aire. Esto se logra a través del Handshake de 4 Vías, que deriva la Clave Transitoria Pareada (PTK) utilizada para el cifrado real de la sesión.

El handshake procede de la siguiente manera. En el Mensaje 1, el AP envía un nonce criptográfico (ANonce) al cliente. El cliente ahora tiene todas las entradas necesarias —PMK, ANonce, su propio SNonce y ambas direcciones MAC— para calcular la PTK. En el Mensaje 2, el cliente envía su propio nonce (SNonce) al AP, junto con un Código de Integridad del Mensaje (MIC) para probar que generó la PTK con éxito. En el Mensaje 3, el AP verifica el MIC, genera la PTK y envía la Clave Temporal de Grupo (GTK) —utilizada para tráfico de difusión y multidifusión— cifrada bajo la PTK. En el Mensaje 4, el cliente acusa recibo y comienza la transmisión de datos cifrados.

Dónde Falla el Modelo de Seguridad

El fallo fundamental de WPA-PSK en un entorno empresarial no es el algoritmo de cifrado —AES-CCMP es altamente seguro— sino la arquitectura de gestión de claves.

Primero, los ataques de diccionario offline representan el principal riesgo criptográfico. Si un atacante captura el handshake de 4 vías (que se transmite en claro), puede ejecutar ataques de fuerza bruta offline contra el MIC capturado. Dado que muchos recintos utilizan contraseñas débiles o predecibles, esto es un ejercicio trivial para las plataformas GPU modernas capaces de miles de millones de operaciones de hash por segundo.

Segundo, la falta de identidad del usuario es un fallo operativo crítico. WPA-PSK autentica el dispositivo, no al usuario. Una dirección IP y una dirección MAC no proporcionan una identidad verificable, lo que limita severamente WiFi Analytics y hace que la respuesta a incidentes sea casi imposible. Los sistemas operativos móviles modernos (iOS 14+, Android 10+) también aleatorizan las direcciones MAC por defecto, haciendo que incluso el seguimiento a nivel de dispositivo sea poco fiable.

Tercero, el problema de la revocación crea una carga operativa continua. Cuando un empleado se va o un dispositivo se ve comprometido, la única forma de revocar el acceso es cambiar la PSK en el AP y actualizar manualmente cada dispositivo cliente legítimo. En un entorno Retail con cientos de ubicaciones y miles de dispositivos, esto es inviable operativamente —y en la práctica, las contraseñas rara vez se cambian.

Guía de Implementación: Transición a la Seguridad Empresarial

Para entornos empresariales, la migración de WPA-PSK a WPA-Enterprise (802.1X) es un mandato de seguridad crítico. El siguiente marco se aplica en implementaciones de Hostelería , Sanidad , Retail y Transporte .

Paso 1: Audite su Infraestructura de Red Actual

Comience con un inventario exhaustivo. Identifique cada SSID, cada método de autenticación y cada tipo de dispositivo que se conecta a su red. Clasifique los dispositivos en tres grupos: activos corporativos gestionados, dispositivos de invitados o visitantes, y dispositivos heredados o IoT. Esta segmentación impulsa cada decision.

Paso 2: Separar el tráfico de invitados y corporativo

Nunca utilice una PSK para activos corporativos. Los dispositivos corporativos deben autenticarse a través de 802.1X utilizando servidores RADIUS y métodos EAP. EAP-TLS (basado en certificados) es el estándar de oro para dispositivos sin interfaz de usuario, como terminales POS, mientras que PEAP-MSCHAPv2 es apropiado para dispositivos orientados al usuario vinculados a cuentas de Active Directory. Para una comparación detallada de estos protocolos, consulte EAP-TLS vs. PEAP: ¿Qué protocolo de autenticación es el adecuado para su red? .

Paso 3: Implementar WiFi de invitados gestionado

Para redes de cara al público, proporcionar una PSK estática es un fallo tanto de seguridad como de marketing. Implemente un SSID abierto que redirija a un captive portal. Plataformas como Purple se integran a la perfección con el hardware existente para proporcionar acceso seguro basado en la identidad. Los usuarios se autentican a través de inicio de sesión social, correo electrónico o SMS, generando una sesión única con un registro de auditoría completo, lo que satisface los requisitos del Artículo 32 de GDPR para medidas de seguridad técnicas adecuadas.

Paso 4: Contener dispositivos PSK heredados

Para dispositivos IoT o hardware heredado que no pueden soportar 802.1X, la contención es la estrategia. Coloque todos los dispositivos PSK en una VLAN dedicada y muy restringida sin acceso a la subred corporativa. Habilite el aislamiento de clientes para evitar el movimiento lateral entre dispositivos. Utilice una frase de contraseña compleja y generada aleatoriamente de 20 o más caracteres, y establezca un programa de rotación.

Paso 5: Integrar con la arquitectura de red moderna

Las implementaciones de red modernas deben soportar políticas de seguridad dinámicas en ubicaciones distribuidas. La integración de una seguridad WiFi robusta con SD-WAN garantiza una aplicación de políticas consistente desde el borde hasta el núcleo. Obtenga más información sobre Los beneficios clave de SD WAN para empresas modernas .

Mejores prácticas y mitigación de riesgos

La siguiente tabla resume los controles clave de mitigación de riesgos para cada segmento de red.

Segmento de red	Método de autenticación	Controles clave	Relevancia de cumplimiento
Personal corporativo	WPA-Enterprise / 802.1X	RADIUS, EAP-TLS o PEAP, revocación por usuario	PCI DSS Req. 8.2, ISO 27001
Invitado / Visitante	Open SSID + Captive Portal	Captura de identidad, limitación de ancho de banda, registro de sesión	GDPR Art. 32, PCI DSS Req. 1.3
IoT / Heredado	WPA-PSK (contenido)	VLAN aislada, aislamiento de cliente, frase de contraseña compleja, rotación	PCI DSS Req. 1.3, segmentación de red

Más allá de la arquitectura, los controles operativos son igualmente importantes. Configure su Sistema de Detección de Intrusiones Inalámbricas (WIDS) para alertar sobre tramas de desautenticación excesivas, un fuerte indicador de un ataque activo de captura de handshake. Si su hardware soporta WPA3, habilite la Autenticación Simultánea de Iguales (SAE) en cualquier red PSK restante, ya que SAE proporciona secreto directo y resistencia a ataques de diccionario offline incluso en modo PSK.

ROI e impacto empresarial

Alejarse de WPA-PSK no es solo una mejora de seguridad; es un facilitador estratégico de negocio con resultados medibles.

Reducción de la sobrecarga operativa: Los tickets de soporte técnico relacionados con las actualizaciones de contraseñas de WiFi disminuyen significativamente cuando la identidad se gestiona de forma centralizada. En una propiedad minorista con 500 ubicaciones, la eliminación de la rotación manual de PSK en miles de dispositivos puede ahorrar cientos de horas de TI anualmente.

Cumplimiento y mitigación de riesgos: 802.1X y los captive portals gestionados proporcionan los registros de auditoría por usuario requeridos por PCI DSS y GDPR. El coste de una multa por incumplimiento de PCI DSS o una notificación de violación de datos de GDPR supera con creces la inversión en una infraestructura de autenticación adecuada.

Monetización de datos: La transición de una PSK estática a un captive portal gestionado por Purple transforma el WiFi de un centro de costes en un generador de ingresos. Los establecimientos que utilizan la plataforma de Purple capturan datos de primera parte con consentimiento, lo que permite campañas de marketing dirigidas, integración de programas de fidelización y análisis profundos del establecimiento, incluyendo el tiempo de permanencia, los patrones de afluencia y las tasas de visitas repetidas.

Términos clave y definiciones

Pre-Shared Key (PSK)

A static passphrase of 8 to 63 characters shared between the access point and all client devices, used as the seed material for generating encryption keys.

The primary vulnerability in small business and consumer networks. When one person knows the PSK, the entire network is potentially compromised, and revocation requires a network-wide password change.

Pairwise Master Key (PMK)

A 256-bit key derived from the PSK and the network SSID using the PBKDF2 hashing algorithm, run 4,096 times.

The PMK is the top-level key in the WPA architecture. Because it incorporates the SSID, changing the network name requires recalculating the PMK on all devices.

4-Way Handshake

The cryptographic exchange where the AP and client swap nonces to independently calculate the session encryption key without transmitting the master key over the air.

The critical phase where offline dictionary attacks occur. If an attacker captures this handshake, they can attempt to crack the PSK entirely offline, with no network interaction required.

Pairwise Transient Key (PTK)

The temporary per-session encryption key generated during the 4-way handshake, used to encrypt unicast data traffic between a specific client and the AP.

Ensures that even though all users share the same PSK, they cannot easily decrypt each other's unicast traffic — though this protection is undermined if the PSK is cracked.

Message Integrity Code (MIC)

A cryptographic checksum transmitted during the handshake to prove that the sender possesses the correct PMK and has successfully calculated the PTK.

The MIC is the target of offline dictionary attacks. Attackers capture the MIC and use brute-force tools to generate matching MICs, thereby discovering the original PSK.

WPA-Enterprise / 802.1X

An IEEE standard for port-based network access control that provides an authentication mechanism requiring each user or device to authenticate individually against a RADIUS server using an EAP method.

The necessary upgrade path for enterprises moving away from WPA-PSK. Provides per-user identity, instant revocation, and a full audit trail.

Captive Portal

A web page that a user of a public-access network is required to interact with before network access is granted, typically used to capture identity, enforce terms of service, and apply access policies.

The modern alternative to providing a static PSK to guests. Enables identity capture, GDPR-compliant consent collection, bandwidth management, and marketing analytics integration.

Deauthentication Attack

A denial-of-service attack where forged 802.11 management frames are sent to force a client to disconnect from the AP, causing it to reconnect and perform a new 4-way handshake.

Used by attackers to actively generate handshake traffic for capture. Detection requires a Wireless Intrusion Detection System (WIDS) monitoring for abnormal deauthentication frame volumes.

RADIUS (Remote Authentication Dial-In User Service)

A networking protocol that provides centralised authentication, authorisation, and accounting (AAA) management for users connecting to a network service.

The core infrastructure component required for WPA-Enterprise deployments. Can be cloud-hosted or on-premises, and integrates with identity providers such as Active Directory, Azure AD, or Okta.

Casos de éxito

A national retail chain with 500 locations currently uses a single WPA-PSK for all point-of-sale (POS) terminals and handheld inventory scanners. They have experienced high staff turnover and are preparing for a PCI DSS compliance audit. How should the network architecture be redesigned?

Deploy a cloud-managed RADIUS server integrated with the corporate Identity Provider (IdP), such as Azure AD or Okta.
Configure the APs to broadcast a dedicated corporate SSID using WPA-Enterprise (802.1X).
Provision POS terminals with EAP-TLS (certificate-based authentication) to eliminate passwords entirely — certificates are provisioned via an MDM platform.
Provision inventory scanners using PEAP-MSCHAPv2 tied to individual employee accounts in Active Directory.
Retire the old WPA-PSK SSID for all corporate devices.
If legacy scanners cannot support 802.1X, isolate them on a dedicated VLAN with MAC filtering and a highly complex, unique PSK per store — and document this as a compensating control in the PCI DSS audit.
Deploy a separate guest SSID with a captive portal for customer-facing WiFi, ensuring complete network segmentation from the corporate environment.

Notas de implementación: This approach satisfies PCI DSS Requirement 8.2 (unique user identification) and Requirement 1.3 (network segmentation) by enforcing individual, identifiable access for all critical systems. Using EAP-TLS for headless POS devices provides the highest level of assurance, while PEAP allows individual accountability for handheld scanners. The documented compensating control for legacy devices demonstrates due diligence to auditors.

A large conference centre provides WiFi to attendees by printing a WPA-PSK on the back of event badges. The IT team is dealing with bandwidth exhaustion, cannot identify malicious users, and is missing out on attendee engagement data. What is the recommended deployment?

Remove the WPA-PSK requirement and transition to an Open SSID for all attendees.
Implement a captive portal solution (such as Purple) for guest access, requiring authentication via email, social login, or SMS validation.
Apply per-user bandwidth throttling policies through the portal to prevent any single user from exhausting available throughput.
Configure content filtering to block known malicious domains and peer-to-peer traffic.
Integrate the portal with the event's CRM or marketing automation platform to capture attendee demographics and consent.
Enable Purple's analytics dashboard to monitor real-time footfall, dwell time by zone, and return visitor rates.
Maintain the existing WPA-Enterprise SSID for event staff and AV equipment, ensuring complete separation from the attendee network.

Notas de implementación: A shared PSK in a high-density public venue offers zero operational control. Moving to a captive portal resolves the identity vacuum, allows granular bandwidth management per user session, and directly supports the business by capturing opt-in marketing data. The analytics layer transforms the WiFi infrastructure from a commodity service into a strategic asset for event organisers.

Análisis de escenarios

Q1. A stadium IT director proposes using a WPA-PSK network for the press box, changing the password before every match to maintain security. What is the primary operational risk of this approach, and what alternative architecture would you recommend?

💡 Sugerencia:Consider the workflow required when a journalist arrives late, needs to connect a secondary device mid-match, or when a credential is shared beyond the intended recipients.

Mostrar enfoque recomendado

The primary operational risk is the support bottleneck and lack of identity it creates. Every journalist must manually enter the new password, leading to support calls and delays during a time-critical event. More critically, there is no audit trail to identify which specific individual is consuming excessive bandwidth or attempting malicious activity. The recommended architecture is a dedicated SSID for accredited press using a captive portal with pre-issued credentials tied to individual media accreditation IDs, or a WPA-Enterprise SSID using PEAP tied to a temporary RADIUS account provisioned for each accredited journalist. This provides individual accountability, instant revocation, and bandwidth management per user.

Q2. During a penetration test, a tester captures the 4-way handshake of your WPA-PSK network and cracks the password offline within four hours using a GPU rig. How does migrating to WPA-Enterprise (802.1X) using PEAP prevent this specific attack vector?

💡 Sugerencia:Consider how the authentication tunnel is established in PEAP before any user credentials are exchanged, and what an attacker would capture from the wireless frames.

Mostrar enfoque recomendado

WPA-Enterprise using PEAP (Protected Extensible Authentication Protocol) establishes an encrypted TLS tunnel between the client and the RADIUS server before any user credentials are exchanged. The user authentication happens inside this secure tunnel. Therefore, even if an attacker captures all wireless frames during the association process, they cannot perform an offline dictionary attack against the credentials — the credentials are protected by the server's TLS certificate. The attacker would need to compromise the RADIUS server's private key to decrypt the tunnel, which is a fundamentally different and far more difficult attack surface.

Q3. A hotel chain wants to improve its guest WiFi analytics to understand dwell times and repeat visit rates, but currently uses a static WPA-PSK for all guest rooms. Why does the PSK model prevent effective analytics, and what specific data does a captive portal solution unlock?

💡 Sugerencia:Consider what data is visible to the network when a device connects using a shared key versus an individualised portal login, and how modern mobile OS privacy features affect MAC-based tracking.

Mostrar enfoque recomendado

WPA-PSK only authenticates the device's MAC address, which is randomised by default on iOS 14+ and Android 10+ for privacy. Because all guests share the same key, the network has no way to link a specific device to a specific guest identity. Even if MAC randomisation were not a factor, a MAC address provides no demographic or identity data. Moving to a captive portal unlocks explicit first-party data: name, email address, loyalty programme ID, marketing consent, and demographic information provided at login. This ties every session to a known user profile, enabling accurate dwell time measurement, repeat visit identification, segmented marketing campaigns, and integration with the hotel's CRM and loyalty platform.