Question

A retail chain offers free customer Wi-Fi using an open (unencrypted) SSID for convenience. Security notices that attackers are setting up rogue access points broadcasting the same SSID with stronger signal to lure customers into connecting, then intercepting their traffic and harvesting credentials from login portals. The business insists the guest network must remain frictionless with no pre-shared key or 802.1X. Which control BEST reduces the risk of these evil twin attacks while preserving open access?

Accepted Answer

Deploy Opportunistic Wireless Encryption (WPA3-OWE) on the guest SSID and enforce HTTPS with HSTS on the captive portal and all customer-facing services

Answer

Increase the transmit power of the legitimate access points so their signal always overpowers rogue APs

Answer

Change the guest SSID to a hidden (non-broadcast) network so attackers cannot clone the network name

Answer

Enable MAC address filtering on the guest network to block unrecognized client devices