One of the most common conditions that the transportation team is caught in when network access certification system is online is"Don't move.". Since access is embedded in the network ' s core control links, any configuration change could result in a massive blackout and long-term attitude towards it by the carrier."Don't move if you can.". To break this state, a useful and valuable log system is the foundation. The following five access logs are supposed to be visible and understandable by the operators when they receive and receive on-line from the system.
The first category is the certification results log, which is the most basic and important.Each authentication request should leave a complete record, whether successful or unsuccessful, including at least the user name (or MAC address), authentication method, authentication time, authentication results, failure code. The real value here is the abundance of the failure code. If the cause of failure is only written"Authentication failed", the log loses the value of quick positioning problems when the carrier is checking one by one. A good system breaks down the reasons for failure to: password error, account expiry, account locking, RADIFUS timeout, equipment nas non-responsive, certificate expiration, terminal Superlicant version incompatibility etc.The more specific the cause of failure, the faster the problem of positioning the carrier.At the same time, trends in certification success rates are visual indicators of system health——If the success rate of certification on a given day suddenly falls from 99.5 per cent to 95 per cent, there must be an anomaly which deserves immediate scrutiny.
The second category is the interactive log of equipment NAS. Access systems interact with switchboards and wireless ACs through RADIUS or Portal protocols, which are a prerequisite for access control to be effective. Three indicators should be noted:Is the SAS device beating normal?(if a switch has not sent a request for certification for long periods of time, it may be equipped with missing or equipment)Response time for the RADIUS report(If suddenly it surges from dozens of milliseconds to the second level, possibly with an overloading or network shaking on the authentication server),RADIUS Retransmits(The high rate of retransmission indicates that the network links are not good in quality.) These three indicators should be included in a system of surveillance alerts, which automatically informs the carrier beyond the threshold.
The third category is the permission change log. This is the focus of security audits, and many of the teams are not paying much attention to them. Who raises a regular employee's network privileges to the administrator team at what time? Who opens access rights for an outside visitor?——Before you do high-risk operations, the system requires a second confirmation or approval. The permission change log is not just about ex post facto accountability; more importantly, it can be used as a clue for daily inspections.It is an effective means of preventing internal security risks.
The fourth category is end-prints and behavior logbooks. In the access scene, only know."Who's in?"Not enough. I need to know."What kind of equipment did you use to access it?"and"Behavioural characteristics of access". A good access system should identify the type of terminal operating system, browser version, and device model that can help a carrier quickly lock up at the end level or network level during a malfunctioning process. Further, if it records the time of the terminal's downline, the location of access (positioned through AP or switch port) and the number of authentication frequencies over a certain period of time, it will aid in determining whether there are anomalies.——For example, the simultaneous access of the same account from multiple geographical locations within a short time or the failure of one device to verify repeatedly dozens of times are security risk signals.
The fifth category is the administrator's log. Access to the system's own security is equally important, and every configuration change, strategy adjustment, user operation that a manager does should be fully documented.It's got to be accurate."Additional time-limits were added to rule 3 of former strategy A"This particle size.. If only you remember"Administrator modified access policy", where a problem arises and what needs to be changed retroactively, only memory or guesswork. At the same time, the operating log should support time-time, operator-type searches that can quickly narrow down the scope of an event survey.
The above five logs cover the five dimensions of authentication events, equipment health, access management, terminal behavior and system operations.The access system is operated once, several times with its own account (successful and deliberate failure) and then on-site to see if the corresponding log is complete, readable and searchable.The log shows a much more problematic view than the functional list.
Advance planning is also needed for the storage and retention strategy of the log.Access to the system logs will grow rapidly after a period of operation, especially for authentication events. Without a reasonable log rotation and archiving strategy, the system disk will soon be occupied, affecting not only systemic performance but also possibly missing key events because new logs cannot write. It is recommended that an automatic log clean-up policy be configured at deployment: nearly three months of detailed logs will be kept for daily dimensions, more than three months of data will be condensed to stand-alone storage devices, with cycles set in compliance requirements. At the same time, the warning threshold for log storage will be configured to provide early warning before space becomes insufficient.
The log system is truly valuable if the support team grows a habit of reading the logs. It is recommended that it take five minutes to quickly cross key indicators and abnormal logs every day early on the system, building judgement about normal and unusual state of the system.——The combination of two means allows access to the system logs to actually come from"Data records"Changed"Transportation of D-assets"。