There's also EAP-TLS and EAP-TTLS for more robust infrastructures. The most sensitive organizations probably just forgo wireless altogether.

You should also regularly scan for things like employees bringing in their own APs (i.e. so they can get their tablet online at work), or connecting WNICs to their systems (to circumvent web filtering by connecting to an open AP).

about EAP-TTLS and EP-TLS yes they are more secure but PEAP is much more common becuase it uses already available credentials and infrastructure most companies already have RADIUS servers and not as many AP vendors sell devices that support or are optimized for  TLS or TTLS so PEAP is the de facto standard for WPA enterprise and the most common implementation of 802.11X and about the recon aspects if you read the wikipedia article on APTs it reads and i bet the FSB, PLA or Iranian Revolutionary Guard could easily and have gotten people into the U.S. or Europe to do B&E so this is just taking it a step forward (or in some cases a step back) and a lot of that recon can be done with OSINT sources, a lot not all. and NACing or DMZing is not a 100% fix all they have to do is pop a computer connected to the wifi but also has a Ethernet connection to pivot and if they use PEAP (which most of the companies where i live do) they already have a set of credentials for the other machine on the network not just the wifi, remember most PEAP implementations use the same RADIUS servers as windows login and even if they don't there is password re-use and derivable attacks. also most APTs have access to HUMINT resources so paying a janitor to re-arrange a few cables to create a bridge into the internal network would not be to hard albeit risky and i don't think they would trust a janitor perhaps a crooked IT person, that is another thing APTs could recruit insiders to do the B&E work as 3xban mentioned and for the being stealthy part some one sitting in a van  down the street is pretty common place where i live and most cities. also most IDS and IPS excluding WIDS/WIPS solutions focus on connections inbound from external sources and in  some government and intelligence agencies i would imagine they could not sniff or log traffic for sensitive departments or projects making a physical access or wireless attack even more stealthy. one of the main problems i have with the infosec and physical security departments in most organizations is they don't work together when they should what good is a strong network based camera and door swipe card system if its control computer can be found via shodan (http://www.shodanhq.com/search?q=GoAhead+Webs+login.asp+no+cache%2C+must+revalidate) and uses ancient software? whats the point of having a multi thousand dollar IDS/IPS solution if its host box's power source can be cut from outside the building? we need to start working with the physical security people more then we do right now, the navy and the army have the marines for a reason.

sil, to be honest that has little to do with the OP other then the fact that it makes more sense to go physical if there are NATs making external attacks more dificult and with the lack of static IPs some  networks use a client system's hostname as a sub domain i don't know why but it does happen so you can find targets that way and static IPed systems such as DNS servers or FTP servers are often vulnerable targets.