The campus network certification management system is only starting and day-to-day maintenance works. When a problem with the certification system, it affects the entire school teacher/student on the Internet, and the pressure on the transport is no less than that of the core business system.
Bottom one: account numbers are secure.
The account number is the first level of the campus network, and the account number has been compromised. The entire certification system is empty. Daily transport guards must maintain password strategies to enforce weak password replacements, support code expiry and blastproof; maintain administrator accounts with minimum role allocation and avoid a super-administ account from being used by anyone; and focus on unusual login, such as multiple login in short time, bulk authentication failure, prompt detection of signs of misappropriation.
Bottom two: Log Audit must stay and be able to find out.
The certification log is the basis for checking problems and security retroactives. The campus accreditation system records the full authentication log, including log time, account numbers, terminals, access locations, authentication results, and retains a specified period of time. Logs are not retained to deal with inspections, but are quickly detected when an account is accessed, during a certain period of time, unusual authentications, or circuit patterns in a given area can be restored from the log. Daily feeds regularly check whether logs are properly written, stored, used, and avoid being found after they have been fully filled or broken.
Bottom three: maintain pages and certificates
Authentication page is the interface that teachers and students want to see every day, and certificates are the basis for security. To check regularly whether the content and links of authentication pages are normal, avoiding page loading failures, jump anomalies, misaligning or outdated information; to ensure that certificates are valid and renewed in a timely manner, an expired certificate will result in browser reporting"It's not safe."The HTTPS certificate, Portal page, and the related window and notice of certification are all included in a routine check-up and the problem is dealt with first.
Bottom four: emergency preparedness for failure
The certification system has a large breakdown and must be clearly prepared. To comb common failure scenarios, such as the authentication server engine, Radius service anomaly, disconnection from the unified identity platform, database malfunctions, each scene needs to have a clear range of impact, process steps and duty bearers.
Bottom five: back-up and inspection to be institutionalized
Accounts, strategy configurations, logs are important assets of the authentication system and must be backed up. The vault and configuration are to be backed up regularly and verify that the backup is restored, avoiding backup but not being able to restore; the configuration changes are recorded and can be compared back-to-back before and after they occur. Daily inspections, including service status, node load, certificate validity, disk space, database health etc., are to be institutionalized and identified ahead of time through surveillance alerts. Inspections are not to go through the field, and check entries are to match real risks with unusual occurrences and are closed for treatment.
Daily operating security of the campus network certification management system, with core maintenance"Account number secure, NATSHEL_LOG_AUDIT, page certificate, fault response, back-up inspection"Each of these five lines is not complicated, and it's difficult to maintain and institutionalize them over time. By making them routine, certification systems can function steadily over the long term, and network centers can be freed from frequent fire-fighting efforts and focus on more valuable networking.