One of the colleagues who have done several web access projects has learned that access to certification systems is not often a function comparison, but rather how access strategies are determined. The functional lists are drawn by everyone, but once they are wrongly designed, the post-line experience, security and transportation costs are very different.
The first strategy to be understood is the size of access: equipment level or user level.Device-level access is a determination of whether the device has been authorized to access the network, typically through the MAC address white list or 802.1X certificate verification. You can verify further user-level access if you pass the device."Is this device used by anyone who authorizes the user?"For example, Portal has a code for the account, LDAP certification, and a micro-mail sweep. The two grains correspond to completely different security levels and management costs. If you have a fixed space in the office area, no equipment moves, medium security requirements are valid, equipment level access is adequate. If there are multiple users sharing terminals, frequent external visitors or high security levels, user level access must be done. Some projects start with simple thinking, go through equipment levels, then find it difficult to handle them later.
The second policy issue that is easily overlooked is what the default action of access failure is.Many people are only concerned about the selection stage."What happens after the access?"Not much."What happens if it doesn't work?"The practical approach to access failures directly affects user experience and network availability. There are three common approaches: direct rejection (the user has no access to any resources at all), isolation VLAN (only limited resources such as visitors portals or IT support pages), release but tagging alerts (ex post-auditing). Three strategies have advantages and disadvantages, direct denial of the safest but worst experiences, and warning is the most friendly and less secure. In practice, most scenarios suggest a separate VLAN strategy that ensures security for core networks without allowing users to lose their connection when access fails and not knowing what happens. The key is to define in advance what resources are within reach of VLAN, and to avoid the isolation itself becoming a neglected security gap.
The third strategic issue is access timing. Some scenarios require users to trigger access certification immediately upon a network connection, which is called pre-access; some sites allow users to access basic applications in uncertified status and then trigger authentication when sensitive resources are needed, which is required. Administrations, government agencies, often require pre-entry, security priorities.Pre- and on-demand access is not a two-way relationship, and good access systems should support hybrid strategies——For example, pre-access to office areas, public spaces on demand, or office hours on demand, and off-site hours. If the system is able to use only one access strategy on a full web basis, it will be very limited in the real environment where multiple scenes coexist.
The fourth strategy is differential access to end types. The type of equipment now connected to a network is much more complex than in the past: employee notebooks, office desktops, mobile flats, dumb terminals (printers, cameras), object networking devices, and BYOD devices. Certification capabilities and security requirements vary widely across different types of terminals. Cell phones and computers can walk Portal or 802.1X authentication, but mute terminals do not have interfaces and only MAC certification or certification. The models are selected with a list of equipment in their actual network, and see if the system can provide suitable access options for different types of terminals.The key is not how many authentication methods the system supports, but whether or not different access methods can be automatically matched by end type in the same network.Access management costs are too high if the MAC white list is to be manually configured for each time a printer is connected.
The fifth core strategy is the change management of access strategies. Access strategies are not set to die at first sight, and changes in organizational structure, new business online, and security compliance requirements trigger changes in access strategies. A good access system should support visualization and change auditing of the strategy, with each adjustment to access rules dating back to operators and operating times.The change of strategy should support the release and rollback of greyscale.——The strategy changes are a gamble, and the range of effects and consequences are uncontrollable.
The five strategy questions, one by one and the firmer by the selection stage, are more relevant than putting the functional list through a long line of time. The flexibility in strategy design is the bottom-line ability to determine project success or failure.
Finally, a procurement judgement that is easily overlooked:The complexity of the access policy configuration has a direct impact on the learning curve of the transport team.Some systems are highly functional, but the strategy configuration interface is designed in a complex way and requires specialized training to operate; some systems are relatively simple but limited in flexibility. It is recommended that the option be used by the operators to actually experience the strategy configuration process and see if day-to-day operations are within acceptable levels of complexity.