Now most WiFi certification systems are going to be on the air."Support the cloud tubes."As a sales point. Indeed, cloud management of WiFi certification platform brings benefits in terms of ease of deployment, concentration of functions and fast-paced functionality. But cloud management also introduces security issues that need less consideration in traditional local deployments.——These issues may not necessarily be exposed at the beginning of the project, but may become security incidents after a period of operation.
Manage the separation of corridors and data channels
The WiFi certification system, in cloud-pipe mode, directly determines the safety baseline by managing the separation of access and data channels. The management channel is a controlled surface communication between AP and cloud platforms, including configurations, state reporting, solidware upgrades, etc.
The ideal design is to manage the passageway and data access completely physically separate.——AP communicates with separate IP and cloud platforms, and the user flow is not through the cloud platform. In some low-value cloud management schemes, however, in order to simplify deployment, users’ certification requests are actually first made to the cloud platform and then to return to the local AC. This poses two security risks: first, that users' authentication data pass through the public network, increasing the likelihood of middlemen attacking and traffic listening; and second, that if cloud platforms are hit or malfunctioning, certification services are stopped.
When assessing a cloud tube WiFi certification program, it is important to know what its flow model is. If management and data are mixed, the application of the site is limited to scenarios where safety requirements are low and compliance requirements are not allowed to do so.
Clouds has its own access control and account security.
The cloud-pipe platform of the WiFi certification system is essentially a centralized portal. If this entrance is taken control, the attackers can do something like: modify all AP authentication strategies, kick off online users in bulk and even launch malicious Portal pages to carry out fishing attacks. This is far more serious than attacking a local AC.
The security measures for cloud-tube platforms should include at least these points: robust password strategy multifactor certification, role-based access control (who has made any configuration changes at what time and who sees the same interfaces as the viewers), operating audit logs (which have done which configuration changes), API calls frequency limits and IP white lists. These security measures seem common sense, but many users do not confirm the actual manufacturer's performance on a case-by-case basis during the actual purchase and use process.
There is also one point that can be overlooked: does the manufacturer’s cloud platform operator have access to client data? If the customer’s data and configuration are publicly available, the vendor’s back-office operator will theoretically have access to them.
Protection of user privacy data in cloud storage and transmission
WiFi certification system will necessarily process privacy data from some users——The data, if uploaded to the cloud end, is related to issues of data exit and privacy protection. Especially for foreign firms or companies with overseas operations, where the data are stored, which countries or areas through which it flows, is a matter that requires very careful assessment in terms of compliance.
A practical operational recommendation is to keep data that involve user personal information locally whenever possible——The phone number Hashi then makes cloud queries, the MAC address is off-the-sighted and the Internet behavior log only uploads statistical results without a clear breakdown. Not necessarily all types of data are processed locally, but at least there is a clear data classification strategy at the programme design stage, which can be captured, which must be left unattractive and not one."All of them."To solve all problems.
API interface security exposure
The cloud tube WiFi certification system usually provides an API interface for the client ' s own business systems to integrate——For example, hotels can connect their PMS and WiFi certification systems, and the residents automatically generate WiFi accounts when they are checked in.
API security basic requirements include that all APIs must walk HTTPS, have to be certified as a client (API Key or OAuth Token), interfaces must have frequency limits and sensitive operations (e.g. bulk export user data) require secondary confirmation mechanisms.——The caller should only operate data within authorized limits and hotel API Key cannot be used to search for hotel B users.
The cloud management of WiFi certification systems is a trend that offers real benefits. But convenience should not be at the expense of security. If the 9 hours happen to coincide with hotel peaks or school hours, the impact is real.——The core functions of certification run on the cloud, management and statistical functions, even if the cloud platform is temporarily inaccessible, without affecting local certification services. This structure is to be defined at the programme design stage because it involves equipment selection and deployment structures that are not subject to temporary change when they are online.