An external security audit made the information-based units of a provincial agency aware that their WiFi network real name certification system had several serious omissions in keeping the logs."Our system is not safe."But..."We really don't know what these are."...that'snotvery rare.
How specific are the statutory requirements for a log to be retained?
Article 21 of the Cybersecurity Act requires network operators to take measures such as data classification, backup of critical data and encryption; while the Information Management Requirements for Internet User Accounts and the Regulations on Technical Measures for Security Protection of the Internet explicitly require that organizations providing Internet access must maintain user logs for not less than six months and that the log contents include user accounts, time spent accessing them, length of access, home number, account number, Internet address or domain name, system maintenance logs etc.
This phrase appears to be a list of examples, but it is understood that each is specific technical requirement."User account"(b) Means that the information must be matched to the actual information and that anonymous storage does not meet the requirements;"Time and length of access"This means that the log particle level is to be at the session level and that each certified log entry is independently recorded;"Internet address"The target IP or domain name visited, which requires that WiFi network real name authentication systems cannot be recorded only"Who's on the log?"And to record it."What did he visit?"The last one."System Maintenance Log"It also includes the operational records of the certification system itself, with marks on who modified the configuration and who consulted user data.
Frequent logs are left blank
In the actual deployment of WiFi network real name certification systems, log retention non-compliance is usually found in several forms.
The first is to record only the authentication log, not the traffic log. The system can tell you which websites or IPs a user has been able to access at some point in time, but it cannot tell you. This is incomplete at the legal level and this log is invalid once a case investigation requires access records.
The second is that the log storage cycle is inadequate. Six months is a minimum requirement, but the default log rotation strategy for some systems is 30 or 90 days, and the carrier is unaware of the need to modify it, resulting in automatic deletion of the logs beyond their retirement period. This omission is often detected at the time of the audit, but historical data can no longer be remedied by that time.
The third is that the logs can be tampered with. Some systems directly enter logs on local disks, without integrity protection, and not in NATSHEL_LOG_AUDIT or read-only storage. In such cases, those with system administration authority may theoretically modify or delete them, with a significant reduction in their legal value. Security audits usually examine the log ' s Hashi verification records or audit chain, which would otherwise be marked as high risk.
The fourth is that the log field is incomplete. The default log format provided by WiFi network real-name certification system manufacturers may not contain all statutoryly required fields, or the field name and format do not conform to the relevant department’s collection specifications. This is particularly pronounced when accessing the Internet access data acquisition interface for public security systems, which is not properly formatted, and the docking fails directly.
Selecting of log system to influence compliance risk
The log module of the WiFi web-based real name certification system is usually achieved by building a database of logs, sending them to an external Syslog server and writing into a unified SIEM platform.
The advantage of the built-in log database is that it is simple to configure, with the disadvantage that storage caps are limited to diskettes on the machine, long-term logs can be rotated and removed, and data are isolated and cannot be analysed jointly with other system logs. Log data may also be lost if the authentication system has a malfunctioning system home.
The central storage and unified management of logs can be achieved by being delivered to an external Syslog server, but there is a need to ensure that the storage and security configuration of the Syslog server itself meets compliance requirements while checking whether the log is delayed or dropped——Some ways of achieving this are to be lost in a network congestion without being misreported, and such losses can only be detected at the time of the audit.
Writing on the SIEM platform is the closest to compliance, but it is most costly and suitable for a security-intensive scenario. If it is a WiFi network real name authentication system for small and medium-sized units, it is usually enough to select Syslog with regular backup to read-only storage.
Relation storage of real-name information and logs
The log retains another detail that is easily overlooked: the real name information and traffic logs need to be able to link to the search, but at the same time they have to meet the minimum rights principle. That is, ordinary operators can find it."A flow log for an IP"But not directly."This IP corresponds to the identity number of who?"; flow records and real name information can be linked only if there is a clear mandate.
This requirement means that the WiFi web-based real name authentication system log database and user-name databases should be stored separately, linked by session IDs or tokens, rather than directly writing identification numbers or names in a log. This should be considered when designing structures, otherwise it is much more difficult to adapt later than initially.
List of self-checking items that are worth doing before the audit
If your WiFi network real name certification system is about to face a security audit, the following self-checks in advance could help avoid common problems: confirm whether log retention has been over 180 days; check if log fields contain session level time, account number, source IP, target IP or domain name; verify that logs have integrity protection mechanisms; confirm whether real name information and traffic logs are stored in a repository and access with minimum permission; check whether the system operates audit logs are complete, including administrator login, configuration changes, etc.
This self-checking list allows most high risk items to be identified and repaired prior to the audit. Log compliance is not a one-time exercise, but a system that needs long-term maintenance.