The security operating system of the enterprise has a central responsibility for the monitoring, analysis, response and disposal of safety incidents. The network access certification system serves as the first line of inner-net security, generating significant access logs and end-security data that are important sources of information for SOC security analysis and threat detection.
Why do you need to connect with SOC?
The network access certification system itself has access control and terminal compliance capabilities, but its perspective is largely limited to:"Network access"This link does not allow the security of the enterprise to be seen. SOC brings together all company security logs and alerts (firewalls, intrusion detection/defense systems, terminal detection responses, Web application firewalls, mail safety gateways, data leak prevention, etc.) to enable cross-equipment linking analysis and threat detection. The value of network access is that, firstly, the network access system synchronizes access logs, end information, compliance status, user identity, etc. to SOC security data sources that can be visible by SOC."Who's connected to the network at what time, from where, with what terminal and under what identity?"; second, a combined response that allows the network access system to be connected when safety incidents (e.g. an end-of-pipe virus, a user account being stolen, an IP attack) are detected and the terminal is isolated or offline to contain threats quickly; third, it is enhanced in context, and SOC can combine contextual information from the network access system (e.g., the terminal ' s access location, user identity, compliance status, historical access records etc.) with more accurate determination of the seriousness and extent of the event, reducing misreporting and underreporting; The fourth is closed-ring management, where safety incidents are closed from detection, analysis, response to disposal, and the network access system as a key implementer of the disposal chain ensures that the safe response can be implemented. For enterprises, network access is linked to SOC, which is built."Testing, analysis, response, disposal"(c) Key elements of an integrated safe operating system.
Access logs to sync with terminal data
Network access systems are linked to SOC on the basis of data synchronization. The network access system requires synchronizing the following data to SOC: first, access event logs for each terminal, including access time, access location (exchange port, AP position), end information (MAC, IP, hostname, operating system, type of equipment), user identity (account number, name, department, role), authentication method, certification results, compliance check results, assigned permission (VLAN, ACL, bandwidth), online duration, traffic usage, downline time and reasons; The second is end compliance data, including details of each terminal ' s compliance check (operational system patch level, anti-virus software status, software list, process list, external usage etc.), changes in compliance status (from compliance to non-compliance and from non-compliance to compliance), details of the non-compliance items; the third is a strategic change log, including administrator changes to access strategy (addition, modification, deletion policy), changes in content, time change, operator; and the fourth is an alert event, including security alerts detected by network access systems themselves (unusual logging, breaching terminal access, authentication of violent breakups, terminal compliance anomalies). Data synchronization is usually done in the following ways: one is Syslog, where network access systems send logs to SOC in real time through a Syslog protocol, which is the most common way and is configured for simplicity and compatibility; the other is API interface, where SOC actively pulls access data and terminal information through REST API interfaces that call on network access systems and adapts them to situations requiring structured data; and the third is database straight-on, where SOC directly accesss the web access system ' s databases, accessing logs and terminals, suitable for scenarios with large data volumes and low real-time requirements; The fourth is Kafka/message queue, which allows high-altitude and low-delay log transmissions through message queues to fit the high-complex scene of large enterprises. Data synchronization requires integrity and real-timeness: all access events cannot be missed, delays in log transfer should be at the second level to ensure SOC can see up-to-date access status in a timely manner. At the same time, data synchronization should be conducted using encrypted transmissions (e.g. TLS) to prevent log data being tapped or tampered with during transmission.
SOC association analysis and threat detection
SOC, when receiving data from the network access system, analyses its connection to other security equipment logs and improves the accuracy and efficiency of threat detection. Common linkage analysis scenarios include: an unusual log-checking test linking logs that access the network to ID systems, VPN logs, finding that the same account number is entered from different locations at short notice (possibly a stolen account), an extraordinary location or an unusual device log-in (perhaps an account was invaded), a large number of log-ins failed during irregular periods (perhaps violent cracking); The second is the end-threat detection, linking network access terminal compliance data to EDR, anti-virus alerts, and finding networks connected but malicious software (EDR warning + access log shows that the terminal is currently online), which allows for timely isolation; the third is horizontal mobile testing, linking changes in network access locations to firewalls, IDS internal traffic alerts, finding a terminal moving from office area to server area within a short time and attempting to visit multiple servers (possibly the attackers are moving horizontally); The fourth is data leakage detection, linking network access to user identification and traffic data with DLP, mail security gateway alerts, finding that a user transmits data externally in large numbers during off-time hours (which may be data disclosure), judging whether there are anomalies in relation to the user ' s department and role; the fifth is compliance monitoring, linking end-of-service compliance data on network access to enterprise safety baseline requirements, and identifying long-term non-compliance terminals (e.g., long-term patches not being filled, long-term non-installation of anti-toxication software) and urging relevant departments to modify their relationships."Context enhancement": A single device alert may be misreported, but combined with the context information (user identity, terminal information, access location, compliance, etc.) of network access allows for a more accurate determination of the authenticity and seriousness of the warning, reduces the analytical workload of security operators and improves the efficiency and accuracy of threat detection. SOC can also use machine learning and artificial intelligence techniques to analyse big-volume access data and safety logs, automatically detect unusual patterns and unknown threats, and enhance the intellectualization of threat detection.
Connecting response and automatic disposal
When a security incident is detected, SOC can connect network access systems to provide automatic response and disposal, quickly deter threats and reduce losses. Common combination response scenarios include: one terminal isolation, when API of the network access system has sent instructions to the switchboard through an end-infection malware or launch attack, assigning the terminal port to VLAN insulated so that it can only access secure repair servers (toxication servers, patch servers), not other resources of the enterprise ' s intranet to prevent threat proliferation; (b) Second, the account is disabled and when SOC detects a stolen user account or has acted abnormally, it disables network access to the account through the Web Access System to enable it to continue its access and prevents the attackers from using the stolen account for further attacks; third, the port is closed, and when SOC detects serious security threats at an access terminal (e.g., access to unauthorized network equipment, large-scale attack), the switchboard is shut down through the Network Access System to directly block all network connections to that portal; Fourth, when SOC detects suspicious behaviour on a user or terminal but does not identify a threat, temporarily reduces its network access rights (e.g. limit access to the Internet and to internal business systems) and safeguards basic use while reducing security risks until security is confirmed, and fifthly alerts that when SOC detects a security incident, it sends a security alert to the affected user via the Network Access System Portal page (e.g., security alerts are sent to the affected user)"Your terminal detected security risks and has been temporarily isolated. Please contact the Security Service."The key to the combined response is to communicate with the security operator and relevant services via mail, text messages, instant messaging, etc."Automation"and"Quick": The window for the disposal of security incidents is often short and may have caused losses if manual operations are required. Automatic detection and automatic disposal of safety events can be achieved through SOC connection to network access systems, reducing response time from hour to second level and significantly increasing efficiency in the safe response. Note should be taken that an automated disposal strategy should be carefully configured: it can automatically isolate high-risk events (e.g. confirmed malicious software infections, clear assault behaviour); low risk or suspicious events (e.g. single unusual login, possible misreporting) should be warned before being manually identified and disposed of, avoiding disruption of normal user networks as a result of false reporting, which could affect business operations.
Security situational awareness and visualization
The data on the web access system can also be used for SOC security situational awareness and visualization to provide security operators and enterprise management with a visual understanding of the safety situation in the enterprise network. Security situational awareness based on the web access data includes: first, a real-time view of current online terminals, number of online users, distribution of regional access terminals, distribution of departmental access users, certification success rates and failure rates, which will keep managers abreast of overall access to the network; The second is a compliance posture, which shows end-compliance rates, non-compliant terminal numbers and distributions, key non-compliance statistics (e.g. no patches, no poison killings, non-compliance software, non-compliance externalities), changes in compliance trends, etc., to inform managers of the overall state of safety compliance at the end; the third is a threat profile showing the number and level distribution of security alerts, type of hot alarms, distribution of threat terminals, distribution of attack sources and targets, changing threat trends, etc., to inform managers of current security threats; and the fourth is a user behaviour profile that shows user usage habits, classification of abnormal behavior users, list of high risk users, etc., to help managers identify potential internal threats; Five are regional security postures, showing access to each region by region (office area, production area, engine room, visitor area, etc.), compliance and threat status, which help managers understand the differences in security risks across regions. Security situational awareness is usually presented through large screen displays, dashboards, heat attempts, trend maps, etc., making complex security data readily accessible."Look."And more importantly,"Use": Guidance on the optimization of security strategies and investment in security resources through situational awareness, assessment of the effectiveness of security measures and data support for security decisions. For enterprises, incorporating network access data into SOC's security situational awareness system allows safe operations"Passive response"Convert"Proactive prevention"• To upgrade overall security management.
Implementation recommendations for combined deployment
In deploying the network access system to SOC, enterprises recommend that it be advanced in the following steps: first, by identifying needs and targets for connection, identifying which data need to be synchronized, what links are needed to respond to the scene, what results are expected to be achieved, and avoiding redundancy and confusion of strategy due to blind association; second, by selecting appropriate data synchronization methods, ensuring data synchronization integrity and real-time availability based on the enterprise ' s network environment, data volume, real-time requirements, Syslog, API, database direct link or message queue; Step three: develop linkage analysis rules, based on the actual security needs and threat scenarios of an enterprise; develop SOC association analysis rules that identify which warning needs are linked to access data, what the conditions and logic of the link are, and what the associated disposal strategy is; step four, configure the alignment response strategy, identifying which safety incidents can be disposed of automatically (segregation, disablement, port closure, etc.), which require manual confirmation, and what level and scope of disposal should be, avoiding the risk that automatic disposal affects normal operations; Fifth, testing and validation is conducted to test the correctness and validity of data synchronization, association analysis, combined response in a test environment, and deployment in a production environment after validation; sixth, implementation of continuous operation and optimization mechanisms for periodic assessment of connection effects, optimization of linkage rules and disposal strategies, updating of threat intelligence, training of security operators. In implementing this, special attention is paid to data security and privacy protection: network access data contain user identification and terminal information that are sensitive data, should be encrypted during transmission and storage, access rights should be strictly controlled to avoid data leakage. At the same time, to select a well-connected network access system and SOC platform, both API interfaces and data formats should be compatible, avoiding disruption of connection effects due to difficulty in docking. Finally, deployment is not combined"Once and for all."However, continuous operation and optimization are required to continuously adapt and refine the connectivity strategy in line with changes in security threats and business development in order to sustain the value of the linkages.
The connection of the network access certification system to the SOC Safe Operations Centre is a key element in enterprise building an integrated security operating system. By synchronizing access logs with terminal data, SOC association analysis and threat detection, linking response to automatic disposal, security situational awareness and visualization, enterprises can make network access data more secure and enhance the accuracy of threat detection, speed of security response and overall security management."Access Control"Equipment, but rather a critical source of data and disposal implementer in the enterprise ' s safe operating system, connected to SOC for security protection"Single-point defense."Convert"Systemic operations"• Provide stronger security for enterprise cybersecurity.