Secure wireless onboarding and network separation.
Connect endpoint controls to network policy.
Reason about rogue devices and lateral movement.
Wireless networks extend the enterprise boundary into physical spaces. Use modern authenticated encryption, protected management, separate guest and corporate networks, certificate or identity-based onboarding, and monitoring for rogue access points. A password shared by everyone provides weak accountability and difficult revocation.
Endpoint security includes patching, host firewalls, disk encryption, application control, malware detection, and least privilege. Network controls should assume an endpoint may be compromised and limit lateral movement.
Exercises
Design guest, employee, and device network segments.
List onboarding evidence for a managed laptop.
Map endpoint failure to network containment.
Self-check
Why separate guest traffic?
What does endpoint posture mean?
Why limit lateral movement?
Self-Check Quiz
1. What is a rogue access point?
AnswerAn unauthorized wireless device that can expose traffic or provide an attacker a path into the network.
2. Does disk encryption stop a running malware process?
AnswerNo. It primarily protects data at rest when a device is lost or powered off.
Homework
Create a wireless and endpoint security baseline.
Design quarantine behavior for a noncompliant device.
Specify monitoring and review evidence.
Sample answerUse authenticated enterprise wireless, separate guest and device networks, managed onboarding, patch and EDR requirements, host firewalls, and least privilege. A noncompliant device is denied sensitive resources or placed in remediation access, with alerts and an audit record.