The WiFi certification system for companies is faced with the reality that employees use their own mobile phones, laptop company WiFi, and that these equipment are not corporate assets, software, escapes from prison, viruses, IT can't handle it. In a Byod (with its own equipment) scene, the certification system has to be accessible to both employees and prevent personal devices from posing security risks, as well as to draw boundaries between company data and personal data. This balance is poorly balanced, either by staff complaining of Internet trouble or by security services saying there are loopholes.
Byod core contradiction
The company wants to control access, for example, whether it has a poison-killing software, the system has patches and any irregularities."Who are you?", do not verify"Your equipment is not clean."The company has issued a laptop certificate and the employee VLAN has access to the Intranet resources. This is not an infringement on employees’ privacy, but also controls security risks at the web level.
Device recognition is the first step of Byod.
The authentication system must distinguish between corporate and personal equipment. The most reliable means is the MAC address white list, where the company ' s assets MAC addresses are entered in an asset management system when certified correctly. But the MAC address can be forged and has no security features. It is safer to have a certificate of equipment, a certificate of equipment issued by the company ' s root certificate for the installation of equipment, a certification certificate at the time of certification, and a different authentication process for personal equipment without a certificate. The EAP-TLS certification method for 802.1X is based on a certificate of equipment with the highest safety but with high complexity of deployment, requiring each company to complete a certificate of equipment.
Byod authentication options
Personal equipment is not suitable for 802.1X because of the complexity of configurations, which does not allow staff to handle. Personal equipment is best certified in Portal plus LDAP, where employees enter a code and domain, and after authentication are assigned privileges according to the type of equipment. Corporate equipment can be automatically certified without sensory access by 802.1X plus certificates. The two certification methods exist under the same SSID, with AC supporting an automatic selection of 802.1X depending on whether the terminal supports a de-grade to Portal. V7 supports multiple authentication combinations that can configure different authentication strategies by user group, equipment type, SSID mix.
Tier design for network privileges
The first level is full access, equipment for distribution to companies and access to all the Internet resources. The second level is restricted access, personal equipment for staff, which allows them only to access the Internet and designated external services (e.g. mail, VPN portal), and internal resources such as file servers, code warehouses, etc. The third level is visitor privileges, which are granted to outsiders, and only Internet access. The third level is achieved through VLAN and ACL, with certification systems returning to VLANID and ACL strategies based on type of equipment and user roles. Personal equipment, even if certified successfully, cannot enter the inner net, which is the safe bottom line for BYOD.
MDM and the certification system
If an enterprise has a MDM (mobile equipment management) system, it can be connected to the certification system. When the personal device of the employee is registered with MDM, MDM issues security strategies (e.g., setting a lock screen password, encryption storage, banning access to escape devices), the certification system uses API to query the MDM compliance status of the device, the compliant equipment grants higher authority and non-compliant equipment only gives Internet access or refuses access."Voluntary registration, classification authorization"Model: The registered MDM personal equipment has more access to the Intranet, and those who do not register are only available on the Internet without being forced.
Control of concurrent terminal numbers
The next employee on the BYOD scene may use a combination of cell phone, notebook, and flatboard equipment company WiFi to account for reasonable number and number. V7 supports maximum simultaneous terminal numbers by user group, 3-5 for ordinary staff, 10 for VIP users. Smaller employees complain about kicks, and too many people share an account number after leaking it. There is also an unusual login test that the same account logs from different geographical locations at short notice, triggers alarms or forced downlines.
Logs and privacy boundaries of personal devices
The company has to clearly inform WiFi in its use statement that following the connection, online behavior is recorded for security audits and compliance retroactives, including access times, source IPs, destination IPs, ports etc., without recording HTTPS encryption. Log retention is required by statute for no less than six months, but within the enterprise it can set a shorter retention period, such as 30 days, to reduce exposure to privacy data.
Equipment clean-up for separating staff
The biggest BYOD pit is the personal equipment of a separated staff member that can be connected to WiFi. The certification system must be linked to personnel systems, the account number on the day the employee leaves is automatically disabled and all online conversations are forced down. If MAC is not aware, the MAC address of an ex-staff member is removed from the white list or the equipment is automatically certified. V7 supports synchronizing with the LDAP or AD domain, the domain number will be disabled and the radios will fail to be used, and users will not have access to it. But MAC's uninsensitive local cache needs to be cleared separately because NATSHEL_SEAMLESS_AUTH does not check domain controls, directly compared to the local MAC table.
The BYOD management of the WiFi certification system is not a technical but a managerial issue. Equipment identification distinguishes between corporate and personal assets, network privileges are segregated risk, authentication options are based on security and experience, MDM is aligned with voluntary models and gives reasonable control of end counts, log boundaries are written into systems, separation clean-up automates.