The first step is to deploy a web-based WiFi certification system, with the right technology and architecture. The head of transport was really awakened in the middle of the night, not because the system was out of reach, but because the regulatory department had a telephone call:"Your WiFi data uploads were interrupted for three days to explain the situation."Security compliance is not an additional question, but a mandatory answer. The wrong answer is not a deduction, it is a direct negative.
Cybersecurity ActArticle 24 makes clear that the network operator provides users with information dissemination, instant communication, etc. and that when signing an agreement or confirming the service, the user should be required to provide real identity information. The public WiFi is a service providing Internet access, and this rule applies. The public security network authorities have been checking the public WiFi real-name registrations more and more frequently throughout the years, moving law enforcement terminals to the shop and finding that there is no authenticated name or data not uploaded, so that tickets can be issued on the spot.
The real name is only the first level.Personal Information Protection ActUsers enter their mobile phone numbers into the WiFi certification page, and the logs and access records stored on the back of the authentication system are personal information. The collection of this information requires a clear message to users for their use, obtaining user consent, not defaulting on a dozen-page user protocols, not hiding in them. For a certification system that handles tens of thousands of authentication records every day, it is extremely difficult to detect leaks and notify each case within 72 hours. So the more pragmatic approach isMake it safe.: database field-level encryption, minimal log access rights, administrator-run full volume audits to minimize the risk of data leakage.
2% waiting.Detailed information security level protection requirements to specific control points. For the WiFi authentication system on the web, the second level includes: identification features that support at least one type of authentication such as username password or mobile phone code; access controls that limit network access based on user identity; and secure audit functions that require certification logs, operating logs, bug logs to be fully recorded for no less than six months. The third level will require more than two combinations: identification must be performed using a password plus SMS code or certificate with biometric recognition; Invasion preparedness is needed to detect and disrupt attacks such as violent cracking, SQL injections; malicious code protection mechanisms are required for regular viral scanning of system documents and uploads; key data and systems configuration require off-site backup, which also requires encryption protection.
The evaluation is not conducted by the operator. The assessment body checks on site the configuration of the certification system, sample logs and tests the integrity of security protection features. Many systems feel that it is not possible to self-evaluate them. When the evaluation teacher returns a record from the log six months ago, he finds that there is no operator information, directly determines that the audit function is incomplete and the entire evaluation is stuck. There are three points for deductions common in the web WiFi certification system; one is incomplete, recording only who has passed the certificate at what time, without any attempt to document the failure, which leads to an untraceable violent debundling; Second, there was no audit of the administrator operations and it was impossible to identify who changed a user ' s bandwidth strategy from backstage; third, the backup mechanism was in disrepair and, although the backup task had been configured, the backup file never performed any recovery exercises and the backup document was found damaged.
Security risks not only from compliance, but also from compliance.Real attack.The middleman attack is a classic threat to the WiFi certification scene. The attackers deploy a false WiFi hotspot in public places, SSID has been set up with a name similar to that of the market WiFi, signal strength is higher than at the mall AP, the user ' s cell phone automatically connects to a fake hotspot, and the assailant sends a fake Portal certification page, which the user entered on the page and the authentication code fall directly into the hands of the attackers. The central means of preventing an intermediary attack is that the Portal page must be used for encrypted transmission of HTTPS, while valid SSL certificates are deployed, and the browser address bar displays a green lock mark so users can confirm that the page is true. In addition, the AC side needs to open a mandatory safe transmission of HSTS to prevent the attackers from downgradeing HTTPs to HTTP.
The attackers have launched a large number of login attempts to authenticate the system, testing user accounts individually with common password dictionaries, and using weak codes to steal access to the Internet or even further infiltrate the intranet once they are tested. The WiFi certification system needs to be protected at both front and back ends: it limits individual IP requests not more than 10 times per minute; it temporarily locks down failed accounts on successive certificates and five times locks them for 15 minutes. These layers can effectively block violent breakups without harming normal users.
The MAC address forgery is an inherent flaw in the MAC certification program. After the attackers have sniffed the MAC address of a legitimate device with their catch tool, modifying the MAC address on their webcards will be used to fake access.
The security of the logs is easily ignored. The authentication system produces a large number of logs every day, containing user ' s cell phone numbers, MAC addresses, access times, and access to site domain names. If these logs are stored on the server in an explicit form, once the server has been broken, the attackers have access to a complete user behaviour database. Logs need to be encrypted and access log operations need to be audited separately, and who checks each user ' s log at what time.
The security compliance of the WiFi certification system on the web is not a one-time overhaul, but a management system that needs to be continuously operated. The actual uploading channels are inspected daily, SSL certificates are prepared for renewal one month in advance, log backups are required to perform regular recovery exercises and when the whole change in the security evaluation is closed.