Sniffing Risk Assessment in Campus Wi-Fi Infrastructure Using ISO/IEC 27001 and the KAMI Index

Background: Campus Wi-Fi networks are vulnerable to sniffing attacks because of their open-access patterns, diverse user devices, and limited security monitoring. Objective: This study assesses sniffing risks in a campus Wi-Fi infrastructure by integrating ISO/IEC 27001 control domains and the Indonesian Information Security Index (KAMI). Methods: A quantitative assessment was conducted using questionnaires administered to five network security experts and 158 students who use the Wi-Fi network. Expert responses were analyzed using Failure Mode and Effects Analysis (FMEA) to identify and prioritize security risks. User responses were assessed through a maturity-level evaluation of various Wi-Fi security aspects using a questionnaire mapped to the relevant ISO/IEC 27001 and KAMI Index domains. Results: The FMEA identified Network Risk Management and Log Recording as having the highest risk priority, with a Risk Priority Number (RPN) of 576, followed by Communications Security, with an RPN of 360. The maturity assessment of Wi-Fi security aspects indicates that all aspects have reached the Defined stage; however, aspects such as Wi-Fi Technology, Performance, Overload, and Stability remain at the Repeatable stage, with an average score of 2.82. Conclusion: The combined expert-judgment and maturity assessments indicate that network risk management, log recording, and communications security should receive priority attention. The findings support regular log review, centralized logging, formal incident-response and escalation procedures, and improved capacity and performance monitoring as risk-mitigation priorities. However, these findings should be interpreted as assessment-based recommendations rather than as evidence that the technical controls were directly tested.