Your Floor Is in Range of Networks You Do Not Control. Wireless Penetration Testing in a Singapore Tower.

01 Your radio perimeter

Which edge you test decides what you find. A vulnerability scan works through a list of addresses you supply. It answers the question you asked. The networks reaching your floor from the riser, the lobby and the tenant above you are outside that list, and they stay outside it no matter how thorough the scan is. Nobody omitted them on purpose. They were never in scope, because they are not yours.

Researchers from the Singapore Institute of Technology set out the resulting mess in CSA's own Cyber Landscape. Each layer of a building network "may operate on different communication technologies ranging from IP to wireless protocols such as Zigbee, Bluetooth, etc to physical point-to-point connections". Different vendors own each layer. Smart buildings "depend on multiple vendors and OT systems with differing technologies and security practices, creating fragmented responsibility where a single weak component or insecure remote access can expose the entire building infrastructure to cyber risks" [ CSA 2026 ] . Fragmented responsibility is the polite way to say nobody tests it.

The same authors cite the SANS Institute report "State of ICT/OT Security 2025", which "found that 22% of the respondents suffered a security incident in their ICT/OT environment". They draw the local conclusion in one line: "organisations locally should avoid relying on the assumption of isolation of the OT systems in their built environments and instead implement layered cybersecurity defences" [ CSA citing SANS ] .

02 Guest to corporate

Guest Wi-Fi and corporate Wi-Fi are meant to be two networks that cannot reach each other. NIST states the rule without room for interpretation: "there should be separate WLANs for external (guest, etc.) and internal use. Devices on an organization's external WLAN should not be able to connect through that WLAN to devices on another of the organization's WLANs." The guidance goes further on routing, saying external WLANs "should be architected so that their traffic does not traverse the organization's internal networks", and closes the executive recommendation with a single line: "Devices on one WLAN should not be able to connect to devices on a logically separated WLAN" [ NIST SP 800-153 ] .

Every network diagram you have been shown says this is true. A diagram is a statement of intent. Proving it means sitting on the guest network and trying to reach the other side, which is a test, not a review. Public sources describe what the separation must achieve. Only a test of your building tells you whether the VLAN, the firewall rule and the controller configuration agree with the drawing.

An attacker crosses anyway by two routes even when the routing holds. The first is a laptop with a foot in both camps. NIST calls it dual connected: "a device that is connected to both a wired network and a WLAN at the same time. The primary concern with dual connected configurations is that an attacker may be able to gain unauthorized wireless access to the client device and then use it to attack resources on the wired network. Essentially this is allowing an attacker to exploit a lower-security network in order to gain access to a higher-security network" [ NIST SP 800-153 ] . A staff laptop docked at a desk, on your cable, associated to the landlord SSID for a call that would not connect, is that bridge.

The second is a rogue access point. NIST: "an attacker deploys an AP that has been configured to appear as part of an organization's WLAN infrastructure. This can provide a backdoor into the wired network, bypassing perimeter security mechanisms, such as firewalls. In addition, if client devices inadvertently connect to the rogue AP, the attacker can view and manipulate the client devices' communications (e.g., man-in-the-middle attacks), as well as potentially gaining access to the client devices themselves" [ NIST SP 800-153 ] . A shared tenant floor, a hot desk and a power socket are all the placement that takes.

03 Shared keys and twins

Count the people who can type your wireless password from memory. Contractors, cleaners and staff who left years ago tend to be on that list. The IETF wrote the clearest description of why that password protects nothing. RFC 8110 describes the venue network whose key is "printed on a sandwich board at the entrance, on a chalkboard on the wall, or on a menu", and then says what people assume about it: "The belief is that this protects the wireless medium from passive sniffing and simple attacks. That belief is erroneous." [ RFC 8110 ]

Read the mechanism in full, because it kills the "well, it is encrypted" answer. "Since the PSK is known by everyone, it is possible for a passive attacker to observe the 4-way handshake and compute the traffic encryption keys used by a client and access point (AP). If the attacker is too late to observe this exchange, he can issue a forged 'deauthenticate' frame that will cause the client and/or AP to reset the 802.11 state machine and cause them to go through the 4-way handshake again, thereby allowing the passive attacker to determine the traffic keys" [ RFC 8110 ] . An attacker who holds the shared key does not wait for you to reconnect. He makes you reconnect.

An adversary beats the modern fix the same way, by pretending to be you. On Opportunistic Wireless Encryption, the same RFC records that it "is susceptible to an active attack in which an adversary impersonates an access point and induces a client to connect to it via OWE while it makes a connection to the legitimate access point. In this particular attack, the adversary is able to inspect, modify, and forge any data between the client and legitimate access point" [ RFC 8110 ] .

CISA names the field version of the same three moves. An evil twin, where "an adversary gathers information about a public network access point, then sets up their system to impersonate it". Wardriving, where people drive "through cities and neighborhoods with a wireless-equipped computer ... searching for unsecured wireless networks". And plain sniffing, where "malicious actors could use sniffing tools to obtain sensitive information such as passwords or credit card numbers" [ CISA 2021 ] . A tower with a public lobby, a food court and a carpark ramp gives all three a place to sit.

Our UK team wrote up a related case this month. Manchester Airports Group disclosed in August 2026 that attackers took the personal data of about 8.7 million people, drawn mostly from terminal Wi-Fi sign-ups alongside car-park, lounge and fast-track bookings. That breach ran through the sign-up form and the data behind it rather than the air. The transferable point holds anyway: guest wireless is a real system, with real data and a named owner, and it rarely gets tested as one.

04 The ceiling and the riser

CSA published a threat identification guide for smart buildings in March 2026, and its scenario table reads like a wireless test plan. For fire and safety systems it lists the entry points as "Network interfaces, wireless controls, operator consoles, physical access panels", against vulnerabilities "Weak/absent authentication, unsecured network protocols, lack of encryption, default passwords, unpatched firmware/software" [ CSA 2026 ] .

A second scenario in the same table is the one that should reach your risk register. An attacker exploits smart lighting or IoT controllers over "Zigbee, Wi-Fi, Bluetooth", where the weakness is "Insecure wireless protocols (Zigbee exploits, replay attacks), weak/default credentials". The affected assets include "corporate/OT networks connected via shared infrastructure". The consequence CSA writes down is "Initial compromise of lighting system leads to lateral movement into sensitive IT/OT networks", and the named mitigation is network segmentation [ CSA 2026 ] . CSA publishes that scenario as an illustration rather than a model of your building. It still maps the route from the ceiling to your file server, with the fix attached.

Those devices multiplied fast. CSA reports that "the number of infected systems detected in Singapore increased to 284,300 in 2025, up from approximately 117,300 in 2024", a rise of 142%, after 81,500 in 2022 and 70,200 in 2023. CSA attributes it to an "expanded attack surface due to proliferation of consumer IoT devices", noting that "such devices may have security weaknesses, such as the use of default passwords or vulnerabilities" [ CSA 2026 ] .

CSA's ransomware count barely moved. CSA logged 165 cases in 2025 against 159 in 2024, with Akira, Qilin and LockBit the most active groups in Singapore, and wholesale and retail trade the worst affected industry at 32 incidents, 19.4% of the total. CSA adds that "SMEs were the most affected, consistent with their generally lower levels of cybersecurity maturity and more limited resources" [ CSA 2026 ] . Read the two figures together. Infections grew 142%. Reported extortion grew 4%. The gap is the part nobody has found yet.

SHARED INFRASTRUCTURE

05 Check the register

Singapore regulates the people who do this work, and you can verify yours in about a minute. Penetration testing and managed security operations centre monitoring are the only two licensable cybersecurity services under the Cybersecurity Act. CSA explains the choice directly: it "adopts a light-touch approach to license only two types of service providers currently", and prioritised them "because providers of such services have access to sensitive information from their clients" [ CSA ] . The framework took effect on 11 April 2022 [ CSA 2022 ] .

A provider needs the licence before the sales conversation. CSRO states that anyone "in the business of providing a LCS, is required to obtain a licence before advertising their LCS" [ CSRO 2026 ] . Working without one is an offence under Section 24, "liable on conviction to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both", and the scope reaches beyond local firms: "Resellers, third-party vendors or overseas CSPs including the affiliates of a licensee who provide licensable cybersecurity services to the Singapore market would need to be licensed" [ CSRO FAQ ] . Companies serving only their own related companies or in-house consumers are exempt.

CSRO refreshes its list of licensed business entities weekly. On the list dated 18 September 2026, the penetration testing section carried 396 licensed business entities and managed SOC monitoring carried 314 [ CSRO 18 Sep 2026 ] . Open the current PDF, search the company name, and match the licence number to the entity on your contract. Red Team Partners Singapore Pte. Ltd. appears in the penetration testing section under licence CS/PTS/C-2022-0168RR.

Then ask about the date. CSRO states that "with effect from 16 March 2026" an applicant must "hold an active Cyber Trust Mark ("CTM") Promoter (Tier 3) or equivalent certification", and that "a grace period until 31 December 2026 will be given for licensees to obtain the required CTM Promoter (Tier 3) certification" [ CSRO 2026 ] . Today is 21 September 2026. That leaves 101 days. The Cyber Trust mark runs "five Cybersecurity Preparedness tiers, with 10 to 22 domains under each tier" [ CSA Cyber Trust ] , and CSA expanded it in April 2025 to cover cloud, AI and operational technology security [ CSA 2025 ] . Any provider quoting you work that runs into next year should answer the question in one sentence.

06 What to settle this quarter

None of this needs a budget cycle. Six things decide whether your floor is defensible, and you can establish all six before the Tier 3 deadline lands.

Your wired estate has been scanned, patched and reported on for years. The air above your desks has not. CSA already says the isolation you were relying on is gone, NIST already says a busy metropolitan tower raises the risk, and the IETF already says the password in the lobby was never protection. Start with the networks in range of your people, find out which of them leads somewhere, and fix that first. Enterprise-grade. Not enterprise-priced. Book the free audit and tell us which tower you are in.