As the Chief Information Security Officer (CISO) at a large university, you are responsible for the security of a campus-wide Wi-Fi network that serves thousands of students, faculty, and staff. Recen

Network segmentation divides the network into zones to limit lateral movement, but it does not authenticate individual users or prevent multiple people from using the same shared credentials to gain access.

Deploying a campus-wide VPN encrypts traffic and can add an authentication layer, but it does not inherently prevent credential sharing and introduces significant infrastructure complexity without solving the root identity verification problem.

Regularly changing Wi-Fi passwords (PSK rotation) only temporarily inconveniences unauthorized users; as long as one legitimate user shares the new password, unauthorized access resumes immediately, making this measure ineffective against deliberate credential sharing.

802.1X is a port-based Network Access Control (NAC) standard that requires each user to authenticate individually using unique credentials (typically via EAP methods integrated with RADIUS and an identity provider like Active Directory or LDAP). Because each session is cryptographically tied to a specific user identity, shared credentials can be detected, revoked, or restricted to a single concurrent session, directly addressing the credential-sharing problem. It also enables granular policy enforcement, logging, and certificate-based authentication options that eliminate shared secrets entirely.