Wireless assessment plan
Radio signals cross walls, property lines, and engagement boundaries. Receiving a signal can be passive while retaining its content, targeting its source, or transmitting a response creates separate scope, privacy, safety, and regulatory questions. Model those decisions before activating test equipment.
When to Use
- Plan wireless assessment for authorized security work.
- Use only within explicit authorization and the stated rules of engagement.
When NOT to Use
- Do not treat this skill as permission to access, test, or change a target.
- Do not convert missing evidence into a clean result or a stronger claim.
Workflow
- State the objective, written authorization references, approved locations, technologies, actions, transmission bands, disruption budget, and data rules. Bind every location to the authorization that names it; do not invent a survey, staging, or observation area to make existing evidence fit.
- Inventory exact radio targets. Separate in-scope systems from excluded and unattributed signals. An observed identifier is not proof of ownership.
- Inventory equipment by receive, transmit, emulate, and write capability. Keep transmit-capable equipment disabled until the plan authorizes its use.
- Start with passive observation. Bind identifiers, channel or frequency, location, time, and signal evidence before proposing active work.
- Record every proposed action against one in-scope target, one location, one device, one authorization reference, a stop condition, and recovery steps.
- Treat protocol reads, association, active enumeration, authentication, credential testing, impersonation, protocol writes, disruption, emulation, and replay as RF emission. Verify written transmission authority and the approved band.
- Give disruptive work an explicit duration and affected-device ceiling. Availability impact includes nearby clients and safety systems, not only the named access point or reader.
- Cover each declared technology across scope, passive inventory, attribution, trust, confidentiality, integration, client behavior, availability, monitoring, and data safety as applicable. Preserve blocked and delegated work.
- Register captures containing credentials, personal data, or bystander traffic and assign a restricted, redacted, destroyed, or other approved disposition.
- Delegate wired segmentation, identity infrastructure, companion apps, backend services, and physical-access consequences with an owner and status.
Interpretation rules
- A visible SSID, device address, tag identifier, or signal is an observation, not attribution or authorization.
- A capture proves only what its location, time, receiver, and recorded band support. Signal strength alone does not prove physical location.
- A handshake or challenge capture does not prove a weak credential. An offline credential test and its result are separate evidence.
- Failure to disrupt does not prove protected management or resilient service; range, channel, equipment, client state, and rate can explain the result.
- A successful association does not prove segmentation failure. The downstream path needs its own authorized evidence or handoff.
- Receive-only authority does not permit active protocol reads, replay, emulation, jamming, cloning, enumeration, or writes.
Rationalizations to reject
- "The signal reaches us, so it is in scope." Propagation does not establish ownership, attribution, or authority.
- "It is an unlicensed band, so transmission is allowed." Band rules, power limits, engagement authority, interference, and local law still apply.
- "One short deauthentication or jam will not hurt anything." Disruption needs an explicit budget and can affect bystanders or safety-relevant systems.
- "We only captured traffic; we did not attack it." Captures can contain credentials, personal data, and unrelated communications that require handling.
- "The SSID and company name match, so this is their access point." Names are forgeable. Preserve attribution as unresolved until evidence supports it.
- "a complete record means we can transmit." It validates the document. Written authorization and the operator still govern execution.
