# (In)Secure Configuration Practices of WPA2 Enterprise Supplicants

**Authors:** Alberto Bartoli, Eric Medvet, Andrea De Lorenzo, Fabiano Tarlao  
**arXiv:** [1806.03215](https://arxiv.org/abs/1806.03215)  
**Date:** 2018-06-08  
**Summary page:** https://www.summarizepaper.com/en/paper/1806.03215v1/

## Key points

- Study focuses on (in)secure configuration practices of WPA2 Enterprise supplicants in enterprise wireless networks
- Investigates awareness of risks associated with incorrectly configuring WiFi-enabled devices before connecting to the network
- Key requirement of WPA2 Enterprise is correctly configured supplicants to prevent attacks and stealing network credentials
- Data gathered through survey among 1000 users and review of 310 network configuration guides provided by administrators
- Results indicate systematic violation of key requirement, suggesting it is no longer realistic
- Only 29 out of 69 institutions published guides describing secure configurations
- Majority published at least one guide leading to insecure or partly secure configuration
- Technicians cannot be relied upon to configure supplicants securely
- Emphasizes need for improved awareness and education regarding secure configuration practices in enterprise wireless networks
- Provides valuable insights into current state of (in)secure configuration practices in WPA2 Enterprise supplicants

## Summary

The study focuses on the (in)secure configuration practices of WPA2 Enterprise supplicants in enterprise wireless networks. The researchers investigate whether users and technicians are aware of the risks associated with incorrectly configuring WiFi-enabled devices before connecting to the network. The key requirement of WPA2 Enterprise is that supplicants be correctly configured to prevent attacks aimed at stealing network credentials, which can provide access to all enterprise services. To gather data, the researchers conducted a survey among approximately 1000 users about how they configured their WiFi devices for enterprise network access. They also reviewed around 310 network configuration guides provided by enterprise network administrators. The results indicate that the key requirement of WPA2 Enterprise is systematically violated, suggesting that it can no longer be considered realistic. Additionally, the researchers analyzed whether the violation of this requirement was due to a few institutions publishing many guides with questionable indications. They found that only 29 out of 69 institutions published guides describing secure configurations, while the majority published at least one guide leading to an insecure or partly secure configuration. This finding further supports the claim that technicians cannot be relied upon to configure supplicants securely. The study concludes by emphasizing that these results do not imply incompetence on the part of technicians but rather highlight a fundamental security assumption in WPA2 Enterprise that is no longer realistic. It highlights the need for improved awareness and education regarding secure configuration practices in enterprise wireless networks. Overall, this research provides valuable insights into the current state of (in)secure configuration practices in WPA2 Enterprise supplicants and raises important considerations for enhancing security measures in enterprise wireless networks.