In The Imitation Game, the German military was completely confident in Enigma. Every message encrypted. Every transmission is “secure”. The whole operation ran on the assumption that the protocol was unbreakable, right up until Alan Turing and the team at Bletchley Park cracked it wide open. The flaw wasn't in the operators. It was in the protocol itself, and the senders had no idea.
WEP was the Enigma of Wi-Fi security. And a lot of networks are still running its spiritual successors.
What Is CIS Safeguard 12.6?
CIS Safeguard 12.6 requires organizations to use secure network management and communication protocols, specifically calling out 802.1X and WPA2 Enterprise (or greater) as the baseline for wireless networks, and extending the principle to all network management communications.
In plain English: stop using protocols with known, documented weaknesses. That means:
- WPA2/WPA3 Enterprise with 802.1X for Wi-Fi (not WPA-Personal with a shared passphrase)
- SNMPv3 with authentication and encryption for device management (not SNMPv1 or v2c)
- SSH instead of Telnet for device CLI access
- HTTPS instead of HTTP for management interfaces
This is a CIS Control 12 safeguard, Network Infrastructure Management, rated IG2+3.
Why It Matters
Weak protocols aren't theoretical risks. They're known attack surfaces with documented exploit techniques and publicly available tooling.
WEP can be cracked in minutes. WPA-Personal with a shared passphrase is vulnerable to offline dictionary attacks, grab the handshake off the air and go home to brute-force it. SNMPv1 and v2c send community strings in cleartext, which means anyone watching the wire can read your network management traffic. Telnet sends everything, including admin passwords, in plaintext.
The German military didn't know Enigma was broken. You don't have that excuse. The weaknesses in these protocols are published, tested, and well-understood by the people trying to get into your network.
Using outdated protocols isn't "good enough for now." It's leaving a door open that your adversaries already know how to walk through.
The 802.1X Piece
This one deserves a little extra attention because it's the most impactful shift for most organizations.
WPA-Personal (the standard Wi-Fi password model) gives every user the same passphrase. When an employee leaves, you either change the passphrase for everyone or you don't, and most organizations don't. That former employee's laptop still knows how to connect.
WPA2/WPA3 Enterprise with 802.1X changes the model entirely. Each user authenticates with their own credentials, tied to your directory (Active Directory, LDAP, or a certificate). When someone leaves, you disable their account and they're off the wireless network. You get per-user authentication, per-user audit logs, and no shared secrets to manage.
It requires a RADIUS server on the backend (which connects back to Safeguard 12.5 nicely), but it's the right architecture for any organization that takes wireless access seriously.
How to Get There: Implementation Steps
- Audit your current wireless environment. Identify every SSID in use, corporate, guest, IoT, legacy, and document what authentication method each one uses. You may find WPA-Personal passphrases that haven't changed in five years.
- Migrate corporate wireless to WPA2 or WPA3 Enterprise with 802.1X. This requires a RADIUS server (NPS, Cisco ISE, Aruba ClearPass, or similar) integrated with your directory. It's a meaningful project but a well-understood one.
- Audit and upgrade SNMP. Find every device running SNMPv1 or v2c and either upgrade it to SNMPv3 with authentication and privacy (encryption) configured, or disable SNMP entirely if it's not being used.
- Eliminate Telnet and HTTP management access. If a device supports SSH and HTTPS, use them. If a device only supports Telnet or HTTP for management and can't be updated, that device needs to go on a hardening roadmap, or onto an isolated management VLAN with compensating controls.
- Document your approved protocol list. Create a short internal standard that defines which protocols are approved for which purposes. This gives your team a clear reference and makes it easier to flag deviations during audits.
- Review annually and whenever new devices are added. Protocols that are secure today may have documented weaknesses tomorrow. Build a review cadence and integrate protocol checks into your device onboarding process.
Final Thoughts
The Germans never got a memo saying "Enigma is broken." That's the nature of protocol vulnerabilities; the people being hurt often don't know it. The difference between them and you is that the weaknesses in WEP, WPA-Personal, SNMPv1/v2c, and Telnet are fully documented and publicly known. There's no intelligence coup required to exploit them. Upgrade your protocols, and you stop handing the easy win to whoever's watching your network traffic.
The CIS Controls v8 documentation is free at cisecurity.org. DM me if you want to talk through a protocol audit or wireless security assessment for your environment.
Official CIS Control and Safeguard Text
CIS Control 12: Network Infrastructure Management
CIS Safeguard 12.6: Use secure network management and communication protocols (e.g., 802.1X, Wi-Fi Protected Access 2 (WPA2) Enterprise or greater).
Shameless Marketing Information
Gotham offers wireless security assessments and network protocol hardening services to help organizations identify and remediate weak protocol usage before attackers do it for them.