One type of problem in the WiFi certification system is that it does not happen every day, but if it happens, it can be very influential.——For example, large-area user authentication failed, Portal pages were tampered with or the authentication server was attacked by DDoS. The level of handling these emergencies directly determines the professionalism of the operators and the reliability of the system in the eyes of users.
First-time response strategy for large area certification failure
The failure of wide area certification is one of the highest-level events in WiFi. The criteria are simple: within the same time frame, there has been an extraordinary and significant increase in the number of failed authentications.——Like a few dozen failures per hour, which suddenly jumps to thousands. The first response of the team in this scenario should be"Stop damage and check it out."Not"First, find the root."。
Order of priority for loss: first confirm whether the server is authenticated——If yes, activate the backup server immediately. Second, confirm that Radius is not available on the server——Check the network links and the status of Radius service. If both the back-up switch are complete but the problem is still, the next step is easily overlooked: checking whether there are problems with upstream networks, such as core switch failures or uplink interruptions that result in terminals not getting IPs, rather than certification systems themselves.
Check after damage stops, focus on two dimensions: time dimension——What time does the malfunction start, what changes around this point; how wide is it?——Are all regions affected or only some AP links? The two dimensions of cross-analysis are likely to be directly located at root.
Emergency processing of altered Portal pages
Portal pages are altered to be a security event in the WiFi authentication system, with priority being given to handling more than normal failures."Authentication page turned into a strange page", or the security department's active scan found. Once it is confirmed that it has been tampered with, the order of processing is: a Portal page (to be replaced by a clean back-up page) which has been altered from the bottom line to the path of the attack.
The focus of the attack path check is whether there are unrepaired security gaps in the Portal server ' s operating system and application layer, whether the account code for managing backstage has been leaked, and if the Portal page files have been cleared and protected. If the attackers have access to the Intranet via the Portal server, the scope of the check will be extended from the Portal server to the entire network environment.
Two follow-up actions are to be undertaken after the restoration: one password replacement for all accounts in the back office and the other a certificate regenerated for the Portal server. The former is to protect against secondary intrusions, while the latter prevents residual risk of intermediary attacks.
Identification and processing of DDoS attacks on authentication servers
The WiFi certification system's Radius and Portal servers are targets that can expose the service port to external exposure.——CPUs are full, UDP buffers spill over and normal authentication requests are discarded. The performance is that the certification page can be opened on the user side but then turns around after entering the authentication code, eventually running out of time.
The difficulty of identifying DDos is that it looks like a large normal authentication peak."The number of requests for certification has increased dramatically and the success rate has declined.". The difference is two ways: looking at the distribution of the source of the request——DDos is usually from a few IPs or web segments, and the normal source of requests for accreditation peaks is dispersed; second, see request mode——DDoS requests are even and continuous, with natural fluctuations at normal human flow peaks.
After the DDoS is confirmed, measures include a temporary ban on export firewalls for suspicious source IPs, request frequency restrictions on Radius servers and cloud cleaning services when necessary. But the most important principle of DDoS treatment is rapid decision-making——At least one defensive measure is to be initiated within 10 minutes of identification and no half-hour meeting can be devoted to the discussion of the programme.
Emergency preparedness for single point failure of critical equipment
Is there a single malfunction in the WiFi certification system? This is a very real problem in an emergency. A core Radius server is dead, a core switch is dead, and a connection fibre is broken.——It is possible to do so in theory, as long as there is a single point.
The emergency response plan should cover at least these scenarios: whether the automatic switch mechanism for the backup server during Radius server failure has been validated, whether the core switch is up to date and if there is any back-up link after the upper links are broken. Each preset transition operation, expected time of transfer, anticipated business interruption window should be documented and rehearsed biannually.
The plan was written and it was over there.——Every network change is followed by a synchronized update of the plan. If the last network modification moves the switch that was originally used as a backup, it's written in the plan."Switch to the backup switch."This plan is a waste. It is as important to maintain the coherence of the pre-project and actual network environment as it is to develop the project itself.
After-action review and problem root analysis
After all the emergencies are dealt with, an ex post facto remix must be done. The remix is not a recrimination, but rather a full time line for the whole event: the question is when it happened, when it was discovered, what point of each response was completed, and how effective each step was. When the time frame comes out, it will naturally be clear which links were delayed and which judgements were wrong.
It's not one of the things to produce after the remix."Lessons learned"It's one."Improving the list"——Each improvement is made clear about the person responsible and when to complete."The Portal server operating system has been identified as having a secure patch not updated and requires three days to complete the repair and establish quarterly patch update processes"——This specific, time-bound action item is the value of a remix.
Emergency response capacity of the WiFi certification system, not on"If something happens, we'll talk."It's built up, but it takes a three-way cycle to keep going. A WiFi certification system that has not experienced any real failure test is not ripe for transport.