One of the company clients told me that their WiFi passwords were public, used by employees and visitors, and that it was long enough to find that the bandwidth was full of visitors and that the employee had a great Internet access card. More problematic is the fact that one time a security check came up and found that the visitor and the staff traffic mixed together, and that there was no way to tell who.
The problem is found in many enterprises, but to a different extent. Let's see how WiFi can be handled in this setting.
Why can't staff and visitors get mixed up?
The WiFi is not a complex matter per se, but it can be mixed into the network of staff members with several practical problems:
The bandwidth is squeezed. Visitors watch videos, download large files, and if they do not do speed limits, the normal office network will be affected. This is one of the most complained situations where IT is held in the middle, while the owner says that visitors are conveniently received, while the employee says that the Internet is too slow.
The perimeter is not clear. Visitors’ terminals and the enterprise inner network are equivalent on the protocol level, and any problem with a visitor device may spread horizontally to the entire inner net.——This risk is real.
The logbooks are not traceable. When a security incident occurs, the logs that have been found can only be at the equipment level and cannot correspond to who is using this device.
Simplest split: two SSIDs running two strategies
This is the basics and the most common practice.
The visitor SSID is open or certified by text message, and the visitor uses his cell phone number to get a temporary password and then logs in and follows an independent visitors policy.
The two SSIDs are physically isolated at the bottom, and visitors' terminals have no access to any of the enterprise’s inner network resources and can only go on the outer net. This is one of the most basic structures in the WiFi certification of a company.
How do you choose the visitor's accreditation?
The short message is the most popular option in a visitor's setting.
The advantage of texting certification is a real name.——The number of a mobile phone corresponds to the specific person and meets most of the regulatory requirements.
A visitor can be certified with a 2-D code.
Mail certification is suitable for foreign visitors or for a particularly large number of visitors——No SMS access is required, visitors leave their mailbox addresses, system-authorized mails to him and links are available online.
What are the limits of the visitors' strategy?
The strategy of the visitors' network is usually several:
The lower bandwidth is recommended to be controlled at 30-50% of the employee passages, without affecting normal office hours."Everyone's on speed."Or..."The full visitor section is shared at speed"——The latter are less aware of the high number of visitors.
The default time for a visitor’s account varies from a few hours to several days, and the expiry date automatically expires.
The network of visitors is only allowed to access the Internet, and cannot visit any segment of the enterprise’s inner web.
Some businesses need to limit the number of a visitor account to several devices at the same time, and prevent visitors from sharing it with many people.
One of the most vulnerable points: the validity management of visitor accounts
The larger the number of visitors will be more and more.——The provisional accounts were sent out with many, fewer real recoverys, long backstages full of historical accounts and confused accounts for everyone who was using them.
The solution is to have the system clean up automatically: a temporary visitor account will fail 72 hours or 7 days after it has expired and no manual processing is required.
The network of visitors and employees is separated, it looks like one more step, actually by separating two issues.——Staff side-checking numbers and privileges, visitor side-pipe traffic and secure borders, each carrying separate dimensions, are more simple than mixing.