The campus network certification system runs for two to three years, and the account system is most likely to become a mess. The numbering of the transfer teachers is still in place, the temporary check-ups of the outsourced personnel are confiscated, and errors resulting from renaming occur. When security audits or system migrations are done, one can drink only. The system is much cheaper than treatment.
The account life cycle is tied to the personnel code.
The root cause of the confusion is network numbers and real identity delinks. Students have valid and graduated from school, but if no one triggers the deactivatement, they will be hanging up. So the best way to do this is to keep the account life cycle running with people and students automatically: a new-born bank, leaving school automatically, and teaching staff to move their rights automatically. This requires that there are established data access channels for certification systems and gradation, personnel systems, rather than requiring administrators to record manually who should sell them."The account number is still there."This has been a matter of human negligence and the system is impossible, and the account number system has stabilized.
Make sure you keep a clear account type.
On campus."Internet users"There are short-term trainees, seconded personnel, cooperative enterprises, and retirements. The duration of each person's terms of reference is completely different. If the same account numbers are used, it will be a mess to manage maturity. We suggest that from the outset a clearly defined system of account types: regular teachers and students, temporary staff, retirements, visitors, and access networks, each with its own type, has default validity and permission templates."Why is this account still there?"Question. Clearing the categories is a prerequisite for the account number to be undisturbed.
The name rule is not to be mined.
The name of the account appears to be small, but it is a pit. If you spell it with your name, you add the number and who will say it for a long time; if you use the school work number as an account number, you have the missing number, and you change the new number. It is relatively safe to use the schoolwork as the main sign because it is not easy to repeat the identity system. But if you write in the need: whether the study number is allowed to be used after it has been cancelled, how do old Internet records are processed when it is used?"New people use old people's online history.". The name rule is fixed, it's in the management code, not just in the mind of a manager.
We need to check the change of permission.
The numbering is not done once. Teachers move from regular to administrator; the authority is increased; students change from undergraduate to assistant, and bandwidth strategies may change. If changes are left unrecorded, there is no way to find who changed them or why. So the log change in the account number system is just needed: who dials what account number when it is transferred, marks can be traced back. This is both a security audit and a self-protection requirement for managers. We see that permission is misdirected and we can only roll back online, with great cost.
Regular audits are more useful than one-off cleanups.
There are also many accounts that are not consistent, such as students who have left school and teachers who travel long-term. So there is a regular manual check to be made on the system: a list of unusual accounts is drawn up every quarter, which are long-outstanding, which are open, which are different types and status. We call this " itemized.""Account number check."The audit is a fixed rhythm that allows the account system to remain clean and not to rot in secret.
Save the emergency access for the manager.
Finally, one easy to ignore: the system of accounts is re-regulated and requires the ability to provide network centres with emergency ciphers and temporary openings. Because if the upstream system fails, the account numbers are synchronized and they are broken, you cannot even get online without local access.
Password policy is scalded by account type
The security of accounts is not as tight as it gets. The master and student codes are too complicated, too often replaced, the password-forgots explode; the administrator's numbers are the strength. We suggest different scales by type: they are moderate, self-help replacements, managers are tough, multifactory. This way holds out the most important and does not bother most people. One-size-fits-all, and then ends up forcing everyone to write conveniently absurd endings, but safety is zero.
The school leaving process is to write off the account number with it.
In the graduation process, the Internet account is written off with a library and a cartoon, so that the checkout is not completed or the check-in is still on. We suggest that the account change be connected to the school leaving process, and that students automatically disable their processing system without having to search for it after the administrator. The check-off event, which is an annual event, will no longer be year-end raids if the account life cycle is plugged into.