The administrator must recode static encryption keys on all clients that use the same keys as the lost or stolen client. The greater the number of clients, the larger the task of reprogramming WEP keys. An access point authenticates a user, but a user does not and cannot authenticate an access point. What is needed is mutual authentication between the client and an authentication server whereby, both sides prove their legitimacy within a reasonable time. Because a client and an authentication server communicate through an access point, the access point must support the mutual authentication scheme.
Mutual authentication makes it possible to detect and isolate rogue access points.
A hacker can reconstruct a data stream from responses to a known data packet. The hacker then can spoof packets. One way to mitigate this security weakness is to ensure that WEP keys are changed frequently. The hacker can use such information to do long-term traffic profiling and analysis that may provide user or device details. To mitigate such hacker activities, a site should use per-session WEP keys.