WiFi certification has a problem of non-retroactive compliance: the site providing public access to the Internet, as required by cybersecurity law, must record users ' logbooks, including identity information and access records, for at least six months. This requires that hotel, mall, school administrators know about it, but there are few projects that can actually be done. The problem is not that it is out of hand."Do it or not."♪ But out of"How can we do this in the long term?". The log seems simple——It is not that data are stored. But it is not complicated to have a data format definition, storage capacity planning, query performance, data clean-up strategy, backup recovery and interface with an external regulatory platform, but when combined, it is a system project that needs to be taken seriously.
What the logs are to remember, how the format is to be decided.
The most basic compliance requirements are to record user identification information and access. Identity information includes cell phone numbers, microsigners, identity cards or membership accounts used for authentication purposes, as well as the MAC address, IP address, authentication time of equipment.——A lot.WiFi certification systemOnly successful authentication events were recorded, no failed certification incidents were documented; only online time was recorded and no downlink time was recorded, which made it impossible to restore the full Internet period for former users; only intranet IPs were recorded, not public network IPs converted through NATs and lacked key information when specific users needed to be traced back.
Another problem with the field definition is type instruction. MAC addresses are separated by a colon or by a cross line? IP addresses are saved strings or integer? Time-tamps are system local time or UTC time? These appear to be small differences that cause enormous problems when cross-system data are needed or evidence is provided to regulators. It is recommended that a standard document for log fields be established at an early stage of the project, with clear length, format and example values for each field, which must be followed by all module log output.
One thing that is easy to ignore: the integrity of a log. If a log file can be modified at will, the log ' s evidentiary validity in compliance review will be significantly reduced. For key security audit logs, consideration should be given to adding digital signatures or at least writing a one-time write medium (Write Once Read Many) to ensure that it is not tampered with after being written.
Planning of storage capacity and rotational cleaning of logs.
This is a problem that was often underestimated at the beginning of the project. For example, in a hotel with 300 guest rooms, 70% daily occupancy rate is averaged at 1.5 people per room and WiFi, each producing about 500 logs per day. × 70% × 1.5 × 500 = 157,500 records. Each record includes identity and behaviour information, which produces approximately 45 MB data per day at 300 bytes per treaty. 6 months of preservation is about 8GB. This amount is not significant for modern storage, but if you add Apache/Nginx ' s access logs, systems logs, application logs, the actual need for storage space is at least 3-5 times that value.
The storage capacity is planned. Next, the log rotation cleanup strategy. Compliance requires that the log be kept for at least six months without all the logs being saved——For example, the system debug logs and access statistics logs do not need to be kept for this long period, so they can be maintained for 30 days. What is needed is a compliance audit log and certification records for a long time.
Also, the medium that a log stores needs to be considered. If a log is written directly on the local disk of the authentication server, it is lost once the disk is broken or the server has reached its trigger.——You can also consider putting logs on an independent log server in real time for items with compliance review risks, and physically segregating them.
Export capability for log retrieval and compliance review.
The logs are not intended to be stored, and they can be quickly detected when needed. When the regulatory authorities come to check, you are usually required to provide complete access to a particular user for a given time period."The logs are on the server, but it'll take two or three days to find out.", this response will be considered to be not satisfactory for log management in the compliance review.
The search is fast but costly if the logs are fully stored in a full-text search engine such as Elasticsearch; if there is a relationship database, the query requires indexing but the search flexibility is less efficient than the search engine; if there is a normal text file, the query can be almost only made by grep and is extremely inefficient. If budget permits, placing hot data (the last 30 days of log) into Elasticsearch for daily queries and compressing cold data (30-to-six months of log) to file storage or object storage is a more mature layer storage scheme.
The format of the export also needs to be agreed in advance. Regulatory authorities usually require export as Excel or CSV, but there may be different template requirements for various web-based services.——Supports screening by time range, user identification, authentication, etc., and export formats allow for the selection of CSV or Excel, and the export log itself should be entered into the operation log to prevent misuse.
Technical preparations for the external regulatory platform.
In many areas, the Internet has requested public places.WiFi certification systemReport the authentication log to the designated regulatory platform in real or quasi-real time. The docking mode is usually a standardized API interface or Syslog delivery. Technology realization is not per se complicated.——It is to add a log forwarding module to the system, which regularly packages logs that meet the format requirements to the specified server address.
But in practice, this docking often raises unexpected problems. For example, API addresses given to the docked documents may not be directly accessible from the hotel network because of network restrictions and require the configuration of agents or VPN tunnels; transmission protocols may be old FTPs rather than safer SFTPs or HTTPs; field order and naming specifications for data formats are not fully consistent with the log format available in your system and need to be field mapping and formatting.
The best way to address these issues is to conduct a docking test at the beginning of the project with local web services to understand actual transmission patterns, network requirements, data format specifications and incorporate them into the system design constraints. Do not switch back to systems before they are online, and if networks are found to be incomfort or incompatible formats then the cost of adaptation is much higher.
The log system's transport dimensions are monitored.
The log system itself needs monitoring. Log files are almost full of disks, log links to the control platform are broken, log clean script implementation is failing——If not addressed, these problems pose a significant risk to compliance. The indicators for monitoring the log system should include: the rate of use of log storage space; whether log writing rates are abnormal (suddenly and significantly increased or decreased); success in synchronizing logs to backup locations; and success in sending the platform to external interfaces.
Some projects are managed by linking logs to existing traffic surveillance systems and other business alerts.——The stability of the log system and the stability of the business system should be one, not one."It's not usually used anyway.". When compliance reviews are really temporary, the integrity and accessibility of the logs directly determine whether you can successfully pass the review.