Study guide
14.3 Secure Wireless Communications
ISC2 Systems Security Certified Practitioner SSCP
Track your progress as you read
Finished sections get a check mark.
1 Introduction and Exam Overview
1.1 Current Exam Facts 1.2 Computerized Adaptive Testing, Scoring, and Retakes 1.3 Eligibility, Associate Pathway, Endorsement, and Maintenance
2 Ethics and Security Concepts
2.1 Comply with Codes of Ethics 2.2 Understand Security Concepts 2.3 Identify and Implement Security Controls
3 Functional Controls, Assets, and Change Management
3.1 Document and Maintain Functional Security Controls 3.2 Support and Implement the Asset Management Lifecycle 3.3 Support and Implement the Change Management Lifecycle
4 Security Awareness and Physical Security Operations
4.1 Support and Implement Security Awareness and Training 4.2 Collaborate with Physical Security Operations
5 Authentication Methods and Trust Architectures
5.1 Implement and Maintain Authentication Methods 5.2 Federated Access with OAuth2, SAML, and OpenID Connect 5.3 Understand and Support Internetwork Trust Architectures
6 Identity Lifecycle and Access Control Models
6.1 Support and Implement the Identity Management Lifecycle 6.2 Mandatory, Discretionary, and Role-Based Access Control 6.3 Rule-Based, Attribute-Based, and Privileged Access Management
7 Risk Management, Visibility, and Legal Concerns
7.1 Risk Management Concepts and Treatment 7.2 Risk Visibility, Reporting, and Threat Intelligence 7.3 Legal and Regulatory Concerns
8 Assessments, Monitoring, and Analysis
8.1 Security Assessments and Vulnerability Management 8.2 Operate and Monitor Security Platforms 8.3 Analyze Monitoring Results
9 Incident Response and Forensic Investigations
9.1 Incident Response: Preparation, Detection, Analysis, and Escalation 9.2 Containment, Eradication, Recovery, and Lessons Learned 9.3 Understand and Support Forensic Investigations
10 Business Continuity and Disaster Recovery
10.1 Business Continuity and Emergency Response 10.2 Disaster Recovery and Restoration Metrics 10.3 Backup, Redundancy, Testing, and Drills
11 Cryptography Foundations
11.1 Reasons and Requirements for Cryptography 11.2 Hashing, Salting, Symmetric, Asymmetric, and ECC 11.3 Digital Signatures, HMAC, Algorithm Strength, and Cryptanalysis
12 Secure Protocols and Public Key Infrastructure
12.1 Understand and Implement Secure Protocols 12.2 Understand Public Key Infrastructure
13 Networking Fundamentals, Attacks, and Access Controls
13.1 Understand and Apply Fundamental Concepts of Networking 13.2 Understand Network Attacks and Countermeasures 13.3 Manage Network Access Controls
14 Network Security Operations, Wireless, and IoT
14.1 Manage Network Security 14.2 Operate and Configure Network-Based Security Appliances and Services 14.3 Secure Wireless Communications 14.4 Secure and Monitor Internet of Things
15 Malware, Malicious Activity, and Endpoint Security
15.1 Identify and Analyze Malicious Code 15.2 Malicious Activity, Social Engineering, and Behavior Analytics 15.3 Implement and Operate Endpoint Device Security
16 Mobile, Cloud, and Virtual Environments
16.1 Administer and Manage Mobile Devices 16.2 Cloud Security: Deployment, Service Models, and Shared Responsibility 16.3 Cloud Legal, Regulatory, and Third-Party Requirements 16.4 Operate and Maintain Secure Virtual Environments
14.3 Secure Wireless Communications
Key Takeaways Explain This Topic AI
SSCP Knowledge Area 6.6 covers cellular, Wi-Fi, Bluetooth, and Near-Field Communication (NFC), plus authentication and encryption protocols: WPA, EAP, WPA2, and WPA3.
Wired Equivalent Privacy (WEP) is obsolete. Original WPA with Temporal Key Integrity Protocol (TKIP) is deprecated. Do not bring them back for 'compatibility.'
WPA3-Personal uses Simultaneous Authentication of Equals (SAE) instead of a WPA2 pre-shared key four-way handshake, adding forward secrecy and resistance to offline dictionary attacks against a captured handshake.
Corporate access should use WPA3-Enterprise (or WPA2-Enterprise) with 802.1X and Extensible Authentication Protocol, not a guest WPA2-PSK written on a whiteboard.
An evil twin is a rogue access point that mimics a trusted SSID. KRACK is a key-reinstallation attack against the WPA2 handshake — patch clients and access points; WPA3 SAE is the protocol-level successor for personal mode.
Last updated: August 2026
Secure wireless communications as a Domain 6 operations topic
Knowledge Area 6.6 — Secure wireless communications — names two piles: technologies ( cellular network , Wi-Fi , Bluetooth , Near-Field Communication (NFC) ) and authentication and encryption protocols ( Wi-Fi Protected Access (WPA) , Extensible Authentication Protocol (EAP) , Wi-Fi Protected Access 2 (WPA2) , Wi-Fi Protected Access 3 (WPA3) ). Domain 6 is still 16% of the SSCP. Wireless items fail people who can recite AES-CCMP but put the EHR laptop on the guest pre-shared key.
Wireless is a network you do not fully own the physical layer of. Anyone in the parking lot can receive frames. Anyone with a travel router can transmit frames that look like yours. Encryption and authentication are how you make that radio path no weaker than a wall jack with 802.1X.
Technologies: cellular, Wi-Fi, Bluetooth, and NFC
Technology Typical range / use What the SSCP actually administers Failure mode
Cellular (LTE / 5G) Wide area; phones, tablets, failover routers, some medical carts Mobile device management (MDM) data policies, private Access Point Name (APN) or VPN for PHI, disable tethering if policy says so IMSI catchers / rogue base stations; split-tunnel cellular that bypasses the campus CASB; an unattended failover router with a default admin page
Wi-Fi (IEEE 802.11) Campus LAN without cables SSID design, encryption/auth, rogue detection, guest isolation, Protected Management Frames (PMF) Open or WEP SSIDs, evil twins, overlapping guest/corporate, KRACK-unpatched handshake
Bluetooth (including Bluetooth Low Energy (BLE) ) Personal area: headsets, keyboards, badges, infusion-pump pairing Disable when unused, controlled pairing, inventory of BLE medical/OT gear Bluejacking (unsolicited messages), Bluesnarfing (unauthorized data pull on misconfigured stacks), headset that is also a microphone next to a nurse station
NFC Centimeters: badges, payments, device bootstrap, some physical access Short-range does not mean "no crypto needed"; control what the badge unlocks Relay/eavesdrop at checkout; a phone wallet that provisions access tokens; NFC used to join Wi-Fi without showing the user the SSID's auth
Cellular is easy to forget because there is no campus SSID. A clinic crash-cart tablet on LTE that uploads images without a virtual private network (VPN) or private APN is an egress path around every 6.5 appliance you racked. 5G private campus networks exist; they still need SIM/identity control and segmentation. Do not treat "it is the carrier's network" as a BAA or a firewall.
Wi-Fi is the bulk of 6.6. Separate service set identifiers (SSIDs) for corporate, guest, voice, and IoT. Guest gets client isolation (no peer-to-peer on the AP) and no route to EHR VLANs (6.4/6.7). Corporate gets Enterprise authentication. Disable older 802.11 rates only when the installed base allows it; do not disable encryption to keep a badge printer alive — put the printer on a dedicated IoT SSID with its own controls.
Bluetooth is a pairing problem more than a SSID problem. Require user confirmation, turn it off on servers and kiosks that do not need it, and watch medical BLE: a pump that pairs to the first phone in range is an IoT issue you will meet again in 6.7. NFC is even shorter range, which attackers solve with a relay or by standing in the checkout line. For SSCP, NFC is not "unhackable because it is close." It is a channel that still needs the same questions: what identity is presented, what is encrypted, what can it authorize.
Scenario — cellular bypass. A provider's personal phone hotspots the EHR workstation when "Wi-Fi is slow." The session to the cloud EHR now rides consumer LTE, skipping the campus proxy, CASB, and DLP. The wireless problem is not the campus SSID. It is an unmanaged cellular path. MDM, hotspot policy, and (if the EHR is web-based) conditional access that dislikes unmanaged networks are the operations answer.
Authentication and encryption protocols: WEP through WPA3, and EAP
The outline lists WPA , EAP , WPA2 , and WPA3 . You still must know Wired Equivalent Privacy (WEP) because stems offer it.
Protocol Crypto / handshake Status for SSCP operations Use it when
WEP RC4 with a reused/weak IV; cracked in minutes with enough IVs Obsolete. Never "WEP-256 for compatibility" Never. Retire the client or isolate it off wireless
WPA (original) Temporal Key Integrity Protocol (TKIP) on the way out of WEP Deprecated. TKIP is broken for current use Migration museum only
WPA2-Personal AES-CCMP , shared passphrase, four-way handshake Acceptable for guest/home-like SSIDs with a rotated key and isolation Guest, printers you cannot 802.1X — not EHR laptops
WPA2-Enterprise AES-CCMP plus 802.1X/EAP per user or device Current corporate baseline still widely deployed Corporate SSID until WPA3-Enterprise is fully rolled out
WPA3-Personal Simultaneous Authentication of Equals (SAE) (Dragonfly); forward secrecy; PMF required Current personal-mode replacement for the PSK handshake Guest/small office where you cannot run RADIUS, and you want offline-dictionary resistance
WPA3-Enterprise 802.1X/EAP; optional 192-bit suite (GCMP-256) in CNSA-style modes; PMF Preferred corporate EHR, finance, admin laptops
WEP is obsolete. If a vendor still requires it, that is an EOL conversation (6.7), not a wireless "mode." TKIP was a patch on WEP and is not a 2026 corporate cipher.
WPA2-Personal uses a pre-shared key (PSK) . Everyone with the passphrase can decrypt traffic that used that PSK (with caveats) and can join. The four-way handshake, if captured, is food for offline dictionary attacks against a weak passphrase. Key Reinstallation Attack (KRACK) (2017) abused handshake retransmission so a victim could reinstall an already-used key, weakening encryption. KRACK is conceptual on the SSCP: it is not a reason to claim "WPA2 is equivalent to WEP," and it is not a Bluetooth bug. The operations response was patch access points and clients , disable vulnerable handshake patterns where vendors said so, and move personal SSIDs to WPA3 SAE , which was designed so that handshake capture does not yield the same offline PSK crack and so that keys are not reinstalled the same way.
WPA3-Personal SAE is a password-authenticated key exchange. Each side proves knowledge of the password without putting a crackable handshake on the air the way WPA2-PSK did. It provides forward secrecy : stealing today's passphrase does not decrypt yesterday's captured frames. Transition mode (WPA2+WPA3 on one SSID) exists so old clients can join; it also keeps WPA2-PSK attack surface on that SSID. Prefer a clean WPA3 SSID when the client fleet allows it.
Enterprise mode (WPA2 or WPA3) uses IEEE 802.1X and EAP against a RADIUS server (6.3). Each user or machine has an identity. You can revoke one without reprinting a wall sign. The access point becomes the authenticator; the RADIUS server is the authentication server; the supplicant is the laptop.
- EAP method How it authenticates SSCP note
- EAP-TLS Client and server certificates Strongest common choice; requires a device PKI
PEAP (often MSCHAPv2 inside) Server cert; user password inside a TLS tunnel Very common. Protect the inner method; still phishing-vulnerable if users ignore cert warnings
- EAP-TTLS Similar tunnel; inner PAP/MSCHAPv2/etc. Same operational story as PEAP
- EAP-FAST Cisco PAC-based tunnel Know it exists; not the default answer over EAP-TLS
- LEAP Old Cisco, weak Do not use
Validate the RADIUS server certificate on the client (or use EAP-TLS both ways) or an evil twin plus a hostile RADIUS will collect passwords.
Protected Management Frames (IEEE 802.11w) , mandatory in WPA3, stop some deauth floods that kicked users onto a rogue AP. They are not a complete evil-twin defense.
Evil twins, guest PSK, and the corporate SSID
An evil twin is a rogue access point (or a laptop in AP mode) that advertises a trusted SSID — Clinic-WiFi , Hospital-Guest — often with a louder signal and a captive portal that asks for the directory password. Open and PSK networks make this easy: the attacker does not need your RADIUS. Enterprise 802.1X makes it harder because the client should authenticate the network (server certificate). Users who click through certificate warnings donate credentials anyway. Operations: wireless intrusion prevention to detect rogue BSSIDs, user training that campus Wi-Fi does not suddenly sprout a hotel-style portal, and never put EHR workstations on the guest PSK.
Scenario — WPA2-PSK guest versus WPA3-Enterprise. Reception prints Guest-WiFi / Summer2026! on a whiteboard. Clinicians join it with EHR laptops "because it is faster." A visitor captures the handshake, cracks the weak seasonal passphrase, and sits in the waiting room on the same Layer 2 segment. If guest isolation and firewall zones were skipped, that visitor is adjacent to clinical traffic. The SSCP design is: corporate SSID = WPA3-Enterprise (or WPA2-Enterprise during rollout) with EAP-TLS or PEAP and a validated server cert; guest SSID = isolated VLAN, no route to EHR, client isolation, a rotated passphrase or a captive portal that does not collect AD passwords, preferably WPA3-Personal SAE if devices support it. Do not reuse the guest PSK on the corporate SSID "so people only memorize one key." Do not disable encryption so NAC can "see usernames."
Exam traps for 6.6
WEP or TKIP as a compatibility feature.
Calling WPA2-PSK "Enterprise" because the passphrase is long.
Claiming KRACK means all WPA2 is as dead as WEP — unpatched handshake reuse is the issue; patching plus WPA3 SAE is the path.
Treating NFC or Bluetooth as out of scope because they are short range.
Trusting a captive portal on a familiar SSID name.
When you sit the item, ask: which radio, which identity (PSK vs 802.1X vs SAE), and can the client authenticate the infrastructure?