Bank points may be the biggest WiFi certification system."- Screw it."On the one hand, banks have almost the highest requirements for cybersecurity in all industries, with a strict segregation of networks in inner-networks, office networks, and experiential areas, and high security levels for terminals and equipment; on the other hand, web sites are also providing customers with WiFi access to the Internet, which is convenient and fast enough to allow clients to run counters.
The NVTHELL_BRAND V7 Authentication & Billing system, in its landscape map, recommended certification of bank points is by double-causing and 802.1X authentication, with the option being text messages and APPs, while the account code is explicitly banned. This mapping itself makes it clear that banking sites are not necessarily a hotel using a code for a transactional account because there is too high risk when office terminals and self-help devices are freely accessed within the site.
First, the customer WiFi level.The user that comes to the site, WiFi, is simply asking: authenticating identity and making it available. The appropriate way of authentication here is SMS certification plus visitor strategy: a client who passes a cell phone number and accesss the visitors' network only through the Internet, without access to the bank’s intranet or office network. Clients are comfortable with their experiences, banks keep records. For regular VIP clients, second-time exemption promotions can be considered, but the validity and application of the waivers are controlled by the safety code of the web site and cannot be exempted indefinitely.
And the floor of staff and office equipment.The office computers, printers, and call-and-point equipment of the site staff are used another route: 802.1X certification with strict access. Terminal access to the network interface is verified before authentication is released so that no legal identity can be accessed even if someone inserts a laptop on the network portal. V7 supports 802.1X certification and exchange or NAC connection, and the scenes where security requirements for banks are high match.
Double factor authentication is appropriate for high-sensitive areas in the network point.For example, wireless access to the financial room, machine room, back office, and back office places, the two-factor factor for account password plus SMS authentication is much more reliable than a single factor. The double-causing in the panorama is the highest security level applicable to finance, government, and core enterprises. Not all regions of the bank network require dual factors, which are graded by region: client area visitors text messages, office areas 802.1X, core area double factor, layered forward.
Here it is important to stress a border: in the banking network program, network segregation is more important than authentication itself."Who's in? How do I check it out?"VLAN and the firewall are solved by"What can you interview when you get in?"The client WiFi, office network, and inner network equipment must be physically or logically segregated, and the customer network can only access the banking core system through certification. This isolation is achieved at the network architecture level, not by a product of the certification system.
The bank projects also pay special attention to compliance and auditing. The customer logs are maintained with the actual name on the Internet, and the portion of the certification log that relates to regulatory requirements is compatible with the audit. V7 supports interface with third-party audit systems, where authentication records and online records can be driven as required, but which audit platforms and data formats are specifically retained for long periods of time, which ones are connected to, and which needs to be confirmed by bank and local regulatory requirements, not in general terms.
Finally, you can check the network role on the bank site: the WiFi certification system is not adapted to hotel or business templates.——Clients, staff, equipment, core areas——The client textes visitors, staff 802.1X, core two factors, and coordinates VLAN's isolation and audit interface, one of these."Leveld authentication plus segregation"The programme is truly in line with the security expectations of the banking points.
The bank site also has a unique need that can be left out of the program: independent certification of equipment. The network counters, call machines, advertising screens, video surveillance of such devices are not humans, cannot play Portal, and cannot enter authentication codes. Either they take the MAC white list or 802.1X machine certification, or they are assigned to separate VLAN separate management.
The same dimension of the service should be said: the number and location of sites are numerous, central management of certification systems and remote drainage capabilities are important. Dozens of sites have to run to deal with authentication issues, which can cost a lot more than they would otherwise do. V7 supports cloud deployment and centralized management, allowing headquarters to look at online users, authentication success rates, equipment status, and problems from remote locations before deciding whether or not to send people.
The banking project has an undervalued link: pre-line typographical testing. The network environment is long, involving customers WiFi, office networks, multiple networks in the experience area, and external reliance on audit interfaces, text channels, etc.——Client SMS certification, employee 802.1X, equipment white list, audit log forwarding——Banks are strictly regulated and tested for network changes, so that they can be extended without adequate testing. The pilot site runs well and is gradually rolled out, the most secure pace of the bank’s projects.