Controllerless Networks

I started reading the iAP VRD and got to page 15 before a question occured to me.

(some background: I'm also on the security team, and tend to think like a hacker)

If I have a cluster of iAP at a location and a bad-guy wanted to hijack my WLAN, would connecting a maliciously configured iAP with the prefered-master box checked effectively hijack my cluster if I haven't checked that box?

Yes, if he has access to the IAP management VLAN.

Joy.

Of course I protect access to that VLAN so it'll be hard to get access. The most likely scenario would be to pull down one of my iAP and plug in his own.

If I don't allow new iAP to auto-join, will the bad-guy's iAP just form its own cluster and leave mine alone?

Also, I set Airwave management in DHCP, will that allow me to hijack bad-guy's iAP?

You would have to accept the attacker's AP in the New AP list for that to happen.  Only whitlisted APS are automatically managed by Airwave.