The company network has one of the most basic strategic hierarchies, but many do projects without sufficient differences: employee certification and visitor certification are two entirely different logics, either in the end by staff members who feel trouble or by visitors. This article does not discuss technology options, but only a few key differences in strategy design and corresponding approaches.
First, we look at the differences in origin of identity.The identity of the staff is derived from the enterprise’s internal human resources system: automatic opening on entry, automatic cancellation upon separation from service, and changes in the status of the transfer of posts and departmental changes. The essence of employee certification is automated access to the existing identification system of the recipient company, without the need for its own registration of accounts or passwords (except for independent web codes). The identity of visitors is acquired temporarily: a one-time account is created at the time of the visit, and recovery occurs automatically after departure. A good access system provides independent visitors management modules, in which managers or receptionists can directly generate a visitor account, specify validity periods and access rights, expire automatically and do not require manual clean-up.
Second, look at the differences in authentication methods.The employee certification is for..."Low friction"——It is better to go online every day at work without having to log in each time you open a browser."Retroactivity"——Each visitor’s access behaviour needs to be documented and linked to specific identities to facilitate ex post audits.
The third key difference is...The range control policy particle sizeThe employee certification allows access to resources such as office networks, internal applications, printers, etc., but there are different levels of authority. For example, the R & D department can access code warehouses, and the market sector can only access the outer network and OA system. This distinction requires access to a system that supports user group-based strategic rules, not all employees equally. After a visitor certification, it is made available only to the Internet and does not allow access to any internal resources. Here is an easy point in practice: is the terminal equipment for visitors and the terminal equipment for staff in the same VLAN? If so, even if the limits of access are logically applied, the second-tier network is separated by matching network configuration. It's better to use multiple SSIDs for physical or logical segregation at the wireless level.——Staff connect to the enterprise SSID with an internal channel and visitors with visitors with a purely Internet-based channel.
The fourth difference is the validity period and time-frame control.Visitors accounts are automatically locked after the specified meeting or visit time, expired visitors ' accounts are cleared automatically every morning and recipient has access to account delays(e.g., a day-long visitor is temporarily staying for an additional day, with the host person operating on the system for a delay without IT intervention).
The fifth difference is that the audit and retroactive requirements differ.——Who's the visitor, when he came in, what network resources he visited, and when he left.The ability to locate the identity and reception information of specific visitors quickly in a log is more important than the integrity of the log itself.A good access system should support log searches in terms of the visitor ' s name, receptionist, visit time, etc., rather than only at an IP or MAC address.
There is also a practical recommendation:Visitors ' accredited entrance pages should be designed in a sufficiently concise manner and not to exceed three steps.Many visitors are unfamiliar with the enterprise’s network environment, and if too much information and options are inserted on the certification page, they probably give up or call a receptionist to help them, thus losing their sense of self-help access.——Three steps are completed. If access is authorized by the respondent ' s sweep code, the process should also be a two-dimensional page containing information about the interviewee that will be identified by the person interviewed and not more than one minute before and after the visitor has been connected to the network.
The integration of the two access lines between staff and visitors is clearly defined, strategies are independently designed and the impact of the access system will be much better.
At the system configuration level, it is recommended that the staff access strategy and visitor access policy be placed in two separate configuration modules, rather than being mixed under one menu.This not only reduces the risk of mishandling, but also allows managers to see at first glance what type of user is currently affected when making strategic adjustments. Moreover, visitors’ management operational privileges are recommended to be delegated separately to front desk or administrative players, rather than tied to staff access and matching authority levels with business management processes.