The grade protection assessment is a closed link to the IT system of domestic enterprises, especially manufacturing, education, and health-care industries. Wireless networks, as an important part of access levels, have key checks in the insurance appraisals. Many projects only find half of them fail to meet their requirements and are costly to modify.
The core requirements for the second level of security are two: identification and access control. Identification means that network access must be certified, not open to network connections; access control means that access through authentication terminals must be restricted and not reached by certification on a full web basis. Both requirements seem simple but actually correspond to wireless system configurations, many projects discover problems at the start of the survey.
The common compliance deficiencies in the identification chain are three. First, the pre-shared key of WPA-PSK is used as a authentication method, which is an explicit and unacceptable way to verify it. The issue with the pre-shared key is that the key is identical at all terminals, that it cannot be traced once leaks are revealed, and that key changes require notification to all known users, often for long periods of time during actual operations. The second is that the Portal authentication page uses HTTP for express transmission, and the account code is sent in an explicit way on wireless networks. This is a serious security breach that any wireless grab tool can intercept. The third is multi-end sharing of accounts, which makes it impossible to distinguish who's using them."Network users should be identified"Direct violations in front of the scene.
The same is true of the compliance deficiencies in access control. Commonly, there are no layers of authority between wireless authentication systems and cable networks, where end-users can access network resources that exceed their areas of responsibility. For example, a normal administrative employee who can access server segments of financial systems through wireless certification is not allowed to wait for secure access control requirements. Another common problem is that terminals are not completely isolated, and wireless terminals can access each other, even scanning other equipment within the same section, which is particularly dangerous for production networks.
The three levels of insurance add several more stringent requirements on a level II basis, requiring special attention. First, the log retention cycle, where the three levels of security require that access logs to network equipment be kept for at least six months, and many wireless certification systems have only 30 days of default log retention, which needs to be manually adjusted in their configuration and confirmed that the adjustments do not affect systemic performance. Second, the three levels of assurance require managers to operate with double-factor authentication, not just account number codes. Third, the system is required to have a security incident retroactive capability and to restore complete access paths through the log when a security event occurs.
There is also a problem that can be easily ignored: the security of wireless authentication systems themselves is reinforced. The assessment body does not check whether the functionality is satisfactory, but whether the system's security configuration is in place. Common sub-buttons include: default port remains unchanged; default accounts are not deleted or changed; management backstage is exposed to non-controlled networks; and patches are not regularly updated. These problems are not addressed when the system is online, and there will be significant pressure on time for pre-evaluation adjustments.
The most effective way to wait for compliance is to write the waiting requirement into a technical program at the project design stage instead of waiting for the project to be finished. In the course of needs studies, target levels are identified, engineers with experience in the assessment of the need are involved in the design of the plan, and technical responses are provided to each wirelessly related guarantee requirement, which is then documented in a compliance matrix document that will be accepted by line by section.
Many companies think that they are good enough to wait, and in fact the evaluation body will conduct spot checks during their life span, which may affect compliance. Wireless certification system configuration changes must be documented, approved, and post-record compliance reverified. It is recommended that such security checks on wireless networks be included in annual safety audit plans rather than being temporarily monitored.