Since the standard of 2.0 for security phase protection in the network was officially implemented in 2019, a new stage has been introduced to build compliance with the university information system. The campus network, which is an infrastructure on which students and teachers depend daily, is usually rated as secondary or tertiary.
The user identification must be unique and the system should ensure that people have a matching number, and no shared account is allowed. Each student and teacher in the campus net setting should use an independent school or work code to authenticate it without having a common cell account. In reality, temporary workers and outsourced personnel in some schools use a shared account, which is a missing item in their evaluation. Locking thresholds and length settings require balancing security with experience——The threshold is too low for users to lose the wrong password, and the number of complaints is locked; it is too high and empty. In practice, five five minutes are missing and an abnormal attempt is confirmed twice in conjunction with a graphics-coded mechanism. The system also supports login time out functions, which, if approved by the user, will be automatically disconnected and recertified if not operated for a long period of time. This mechanism is particularly important for library public computers, hangar terminals, etc., and less likely evaluation is overrated.
Access control is another priority. The principle of minimum privileges is required by the second guarantee, whereby users of different players can only access authorized resources. The campus network certification system requires a fine-scale access control that cannot be simply and bluntly either released or rejected. Further, some particular scenes require more fine particle size.——This requires that the certification system support ACL under-production based on user groups, with dynamically injecting different access control strategies into authentication passage. The realization level usually uses RADIUS 's Filter-Id or manufacturer’s private attributes to transmit strategic markers and access switches according to a predefined ACL set of rules for marking matching.
Security audits are the longest and most demanding part of the insurance 2.0. Audit records generated by certification systems must cover every user, each operation. Specifically, audit logs need to contain the following fields: time of occurrence, exact to second; user identification, i.e. a school or work number; type of event, including log-in success, log-on failure, write-off, account locking etc.; outcome, success or failure; link between source IP address and MAC address. For university schools of 10,000 size, the daily amount of certified logs is hundreds of thousands of grades, cumulative for six months, and tens of millions or even billions of records. This requires efficient storage and retrieval capabilities in audit systems. It is now more common to store original logs with compressed logs in NAS or object storage for long periods while keeping hot data up to the last month in the Elasticsearch cluster for quick retrieval.——Audit records cannot be modified or deleted at will, and strict control of authority and anti-false mechanisms are required.
In terms of data security, the user password must be protected during transmission and storage. At the transfer level, authentication protocols should prioritize CHAP instead of PAP. AP transmits passwords on the network in a specified way, amounting to naked run-off in shared local area network environments. RAP uses challenge response mechanisms, service end creates random challenge codes for distribution to clients, and client calculates the response values with post-Hash code and challenge code, which are not themselves available in the message. At the storage level, user passwords in back-office databases must be stored after saline Hash and strictly forbidden from being saved. Salt values should be generated independently by random selection of each user, preventing batch recovery using rainbow tables. Even if the database is towed, the attackers will have to break it violently on a user-by-user basis, with significant increases in time and computing costs. It is also recommended that regular user changes be made to passwords, but this strategy is difficult to implement on campus networks——Students are generally distasteful about changing passwords. The compromise is to increase the password strength, make the initial password complex enough to reduce the probability of being broken by violence, while retaining an unusual login test as a cover.
The end access control is a security requirement waiting for the 2.0 additional security, which is not specified in old versions.——Whether the operating system patch is up to date, whether the anti-virus software is installed and operational, or whether the system firewalls are open. Equipment that does not meet the security baseline should be placed in a perimeter area, only access to the patch server and the safety strategy guide page will be mandatory before it can be connected to the normal network. This requires more frequent deployment of 802.1X in the teaching office area, which will be done in conjunction with access control products by third party networks. Attention should also be paid to the multiplicity of initial status of new computers during the school year, where the capacity of the area of separation is set aside in a flexible manner at that time, or where large numbers of freshmen are blocked off the repair page.
Compliance is not a one-time project. The security assessment is done every two years, but the system ' s safety status changes daily. Certification systems need continuous monitoring and continuous optimization to internalize compliance requirements into routine dimensions rather than a two-month overhaul before evaluation.
(approximately 1920 words)