The network of campuses is not open to the public, and students are using a real-name account. By definition, this should be one of the most “clean” online environments. But that is why universities face stricter requirements for cyber security compliance.
Article 21 of the Cybersecurity Act of the Ministry of Public Security clearly states that network operators shall take technical measures to record and retain log information accessed by users for a period not less than six months. For higher education institutions, this means that students must maintain data on which account number, when and what address they visit and how many traffic flows they generate, and that they should be able to match their true identity over time.
This is a hard indicator that the information sector in universities must focus on when selecting fee-based systems.
The difference between the nature of the system and that of the audit
Many people can confuse the concepts of "fee system" and "audit system." The core functions of a billing system are authentication and billing, who I am, whether I pay for it or not, what my package is. The central function of an audit system is log retention and behavior records, what I visit, when I visit, from which IP.
A good billing system will have built-in audit functionality, but professional auditing systems usually have improved data storage and query capabilities.
The NatShell V7 Authentication & Billing system supports the interface with mainstream public security auditing systems, and data formats and interface protocols are validated by a large number of projects. For higher education institutions that have an assessment requirement, this is the most basic selection threshold.
Technical requirements for the retention of a log
At the technical level, the audit log needs to meet several basic requirements.
Completeness. All users must record the authentication records and access records generated online, without any omission.
Accuracy. Time stampes are accurate to seconds, and IP addresses are able to interpret the specific end-of-life device.
It's not tampered with. Log data needs to be protected against manipulation and avoid being deleted or modified. This is particularly important in the context of judicial evidence.
The log module of the V7 system is designed in accordance with these principles. Log data are stored in a separate data area, separated from operational data, and there is a well-developed backup mechanism.
Practical details of interface with public security audit platforms
When the university interfaces with local security network security services, it usually involves the following:
First, the data format confirms that the audit platforms used by public security services vary from place to location and the requirements for data are different. V7 supports flexible data field mapping that can be adapted to the format requirements of audit platforms in different regions.
Second, the transmission options. Log data uploads can be either in real time or regularly synchronized. Real-time transport requires more bandwidth and system than it is in time; regular synchronization is simple but there are delays in data.
Third, docking tests and acceptances. Before officially entering the line, you need to test data docking with public security authorities to verify field integrity, time accuracy, transmission stability.
In the course of implementing the project, NATSHEL_BRAND will cooperate with schools in completing their docking tests with public security services to ensure that data are met and received successfully.
Specific requirements for the second degree of education
The criteria for waiting for insurance 2.0 differ from one security level to another.
In terms of access control, the billing system needs to be able to distinguish between different user roles and send different network access rights to the device end.
Audits are retroactive, and the security incident requires that the log be accurately linked to the user’s identity and that the query function be easy enough.
The back-up cycle and the restoration test are recorded.
The V7 system competency management module supports role-based access controls and allows for the matching of insurance requirements by dimension strategy such as user groups, operators, campuses etc.
Balance between privacy protection and compliance
In order to promote the Internet, universities need to work out two relationships:
The first is the relationship between compliance and ease. Students want to be simple, not "talked" about online processes; public security authorities require data to be complete and traceable.
Data access is a valuable asset for analysing students’ habits in accessing the Internet and optimizing the allocation of resources on the Internet.
NATSHEL_BRAND recommends that universities use the billing system to clarify the scope and authority of data use, establish an internal data management system and avoid data abuse.
Compliance checklist for selected models
The University Information Services can assess compliance capacity in the following dimensions when selecting a system for calculating fees:
Whether interface with local public security audit platforms is supported and data formats are configured.
Whether the log retention cycle meets the requirements of the regulations and whether export and query support is provided.
Whether log data are tampered with and whether there is a backup or recovery mechanism.
Whether to support the connection with school identity sources and to achieve an accurate link between user identification and account numbers.
The assessment support material is available, pending success stories in the evaluation of insurance.
The NatShell V7 NATSHEL_AUTH_BILLING system has a complete technical programme in compliance with the requirements of completing the evaluation of insurance and public security audits.