Many companies, when deploying wireless networks, customarily apply the employee certification programme directly to the visitors ' scene, believing that it is only possible to treat visitors as if they were in a situation where they were not allowed to use their own network."Special staff"In fact, the operational logic of the Wireless Network and the network of employees differ in essence, with the same system and strategy to manage two distinct user groups, often leading to security gaps and experiences. We have experienced this in projects at several manufacturing factories: visitors WiFi, who are exposed to external displays because they follow a staff certification system, control of their rights, security services are nervous; and clients or government officials who come to factory inspections, complain about users’ poor experience because the certification process is cumbersome and connections fail.
The core features of the visitors’ network are three: untrustworthy user identity, uncertain access times and a single access requirement."I know who you are, and you work here for a long time. You have a reasonable need for access to the Intranet.". The premise of the visitors' network is completely different.——I don't know who you are, how long you'll be on this network, and you shouldn't have access to any of the resources on the Internet. These two premises make a very different design logic.
The first difference is in the way you verify it.——The temporary account management problem arises when a visitor is processed using the employee certification system: missing the deleted visitor account for long periods of time becomes a potential security risk; there is no mechanism to automatically cancel his network access rights after the visitor leaves. The correct approach is that the visitor account must be time-bound, with reception records tied and the corresponding network privileges at the time the visitor leaves are automatically disabled without manual intervention.
The second difference is in network isolation. After the employee's access to WiFi, he can theoretically access all resources within his domain on the intranet.——File server, business system, production data. But visitors should never have access to it, even if they're just..."Maybe."The network of visitors must be completely independent, with no access to the Intranet. Many projects have been problematic at this point because the wireless network VLAN is not well planned, and while the visitor SSID has been separated, it is not strictly segregated at the core switch or gateway level, and visitors’ terminals can actually access intranet resources through certain routes. This is a very easy security gap in the production environment to ignore.
The third difference is in bandwidth control. Staff needs are continuous, regular office requirements require stable network bandwidth and temporary speed limits affect experience. But visitors need a one-time, short time, e.g. an email and a look at information. It is reasonable to have a bandwidth ceiling for the visitor ' s network, but this ceiling has to be set in conjunction with actual scenes. Visitors to the factory exhibition hall may need to see videos and display products, visitors to the research and development area may simply check mail, and visitors ' bandwidth strategies should vary from region to region. If bandwidth controls are not in place, high-flow applications for visitors will have a direct impact on the normal use of staff networks.
The fourth difference is found on the NATSHEL_LOG_AUDIT. Logs generated by staff networks are part of daily network carriers and log fields are relatively fixed. But logs produced by visitors ' networks have a special compliance value: at some point in time, who have access to the network and what Internet resources are important when security incidents are traced and compliance checked. Many companies’ visitors WiFi logs are incomplete, either the system itself has no records or the hosts do not register visitor identification information, resulting in the end-of-visit account being only one cell phone number or an ad hoc account that cannot be linked to specific visitors. This problem requires that the log field be defined at the system design stage and that"Visitors ' identity"As a mandatory fillout, it cannot be left empty.
Finally, we will discuss the operational delivery of the visitors’ network. After many projects have been delivered wireless coverage to the factory IT department, the daily operation of the visitors’ network is actually the responsibility of front office administrators, not IT. But administrative staff often do not have network expertise and are completely unaware of how to handle problems such as lack of connectivity, speed of web access, certification failure.