Most of the discussions on WiFi network real name certification system focused on selection and deployment phases——Select which platform, how to access the network, and what kind of authentication. But when a system is online, it's the real problem that starts. The article looks at the question of what you do not see in the first year but then begins to show up in the second year.
The account is getting bigger and harder to clean.
Any real-name certification system has problems with the life cycle management of accounts. The accounts should be disabled or deleted when employees leave the company, students graduate from school and tenants return their rents in the campus. In theory, these numbers automatically fail if the account numbers and data sources (HR systems, engineering systems, PMS) are synchronized. But the reality is that synchronization is often one-way, periodic rather than real time; some accounts are created manually without matching data sources; and the synchronous script runs for a long time and no one has been able to verify whether it works properly.
Two years later, there's probably a lot of them in the account."Zombie account number."——Accounts exist, are in a state that is enabled, but the corresponding person is no longer available. These accounts do not necessarily create security problems (because the password is still that code and it will not be easily guessed), but they cause trouble at the time of audit: the system shows them."Active Account"It's much more than it actually is. When someone asks,"Current list of registered users", the exact number cannot be given.
Another difficulty in clearing accounts is that there are no credible references. If the account numbers are synchronized from LDAP, do they keep records of all staff separating? If the account numbers were created manually, did they record the department and validity period when they were created? When this information is missing, the clean-up becomes a semi-conscious process that is difficult to systematically move forward.
Log growth is higher than expected, and storage pressure is increasing.
The estimate of log volume is often low when online. After a period of actual operation, storage capacity is consumed faster than expected, especially after user numbers have grown or traffic strategies have been liberalized.
Another problem is that the journal ageing strategy is not carefully designed. You need to keep a log for six months, and some systems will be deleted automatically after six months, or no.——The logs were kept six months ago, occupying storage space, but actually exceeded the retention period required by statute and there is no need to keep them. If not configured, the journal ageing strategy will recur in the event of limited storage resources"The storage is almost full."The police are warning that the carrier will spend time cleaning it up manually.
The integrity of the log is also a matter of protection that can be ignored. After some time has passed since the system was operational, does anyone check regularly whether the log is actually being written? Did any time have an interruption due to disks full or service crashes? If an accident really occurred and it was necessary to trace the time logs, it would be difficult to find that they were missing. It is recommended that log integrity monitoring be set up, that automatic log writings be automatically verified on a daily basis within reasonable limits, and if logs are abnormally low on a given day, prompt warning.
Compatibility risks associated with system upgrades
The WiFi real-name certification system has been continuously updated by the Shop of Commerce to fix security gaps, add new features, and adjust interfaces. But each upgrade is a risk point for existing deployments: the style of Portal pages changed after upgrading and user authentication behaviour changed; interface fields were adjusted and interface with third party systems (LDAP, PMS, SMS); a previously closed function was defaulted on the new version, changing the current authentication strategy.
True case: A school upgraded the little version of the authentication platform, and it was discovered that the Portal page on the iOS device had changed in logic from an automatic window to a manual click notice. This change was not mentioned at all in the update log, and IT was completely uninformed, with hundreds of students responding on the first day."WiFi couldn't get the authentication."The team took half a day to locate it as an upgrade.
It is recommended that a version upgrade review mechanism be established: before each upgrade, the critical path of the certification process (Portal pop-up, authentication completed, roaming maintenance) will be validated in a test environment; the upgrade operation will be arranged at low peaks; the first working day after the upgrade will be maintained on duty with attention to user feedback."Upgrade. Upgrade."Any change in behaviour of the irrelevant component directly affects users ' experiences with Internet access.
Knowledge faults due to loss of carrier personnel
When the system is online, one or two IT personnel usually engage in a profound process of implementation, familiarizing themselves with the architecture, configuration details, and various pedal pits. This knowledge is very much in their minds and not documented. Once these two individuals leave, they will have to start from scratch, and problems will be encountered only by contacting suppliers, who respond at varying speeds and quality.
This problem is prevalent in IT infrastructure, but certification systems like this"Key Paths"The component is particularly prominent because it has a high degree of impact and time pressure for positioning and restoration once problems arise. It is recommended that, three months after the system has been stabilized, the then implementing officer should export a transport manual covering at least: the system architecture map, list of key configuration parameters, routine failure check steps, supplier contact details.
Authentication is not keeping up with user habits.
The authentication method chosen two years ago when the system went online may be outdated today. For example, two years ago SMS was a mainstream authentication and user acceptance rate was high; but more users are now tired of waiting for SMS and prefer to sweep micro-mail 2D or brush their faces to complete certification.
Another change is that"Uncertified"The standard two years ago was that no internal network equipment (such as printers, projectors) needed to be certified; but with increased security awareness, more and more sites now require all equipment to be certified, including IOT equipment and conference room screens. These devices do not support Portal certification, which requires a white list of MAC addresses or 802.1X certificates, both of which are much more complex in configuration than Portal certification. If the authentication system did not support these methods, it would now have to be filled and the renovation work done.
Compliance requirements change quietly
The requirements for WiFi real name certification are not static. For the last two years, there have been varying adjustments to log word requirements, length of log storage and presentation of authentication page information. Some systems built according to old standards needed to be updated to meet new requirements.
It is recommended that a self-check be conducted every year to check the integrity of the main body of information on the Portal page, whether the log field covers the latest requirements, whether the storage time frame is met and whether the real name authentication depth is satisfied. The problem will not wait until the passive examination is detected, and the timing pressure for modification will be high.
The problems of the transportation phase are less visible than those of deployment, but they have accumulated to some extent and are not dealt with as cost-effectively as a redeployment of a system. These long-term issues can be integrated into the life cycle management of the system well in advance if the infrastructure is to be truly stable over the long term.