Network security equipment deployment method

Abstract

The invention provides a network security equipment deployment method, which comprises the following steps of: planning and designing existing network security equipment deployment, planning and configuring network security equipment which is newly put into operation, inputting network equipment planning information, generating a network equipment configuration table, and generating log records for purchased security equipment. A detailed implementation scheme is formulated during cutover, switching or upgrading implementation of operation equipment, network equipment is installed and debugged, a solution scheme is formulated for accidents and emergencies, and equipment operation and daily maintenance training are carried out on network management personnel after installation and implementation of the network security equipment are completed. According to the network security equipment deployment method, the problems that the installed network equipment must be configured, high-degree user knowledge and participation are required, and debugging may be quite boring and difficult for a final user lacking the task experience are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security device deployment method. Background Art

[0002] Network security issues have become increasingly severe. The rapid development of cloud computing, big data, and artificial intelligence has added great challenges to network security. If network equipment as an infrastructure is attacked, it will lead to the interruption of the company's production data and business, or even data theft. For relevant departments, there is no need to connect to the Internet, but the internal network equipment uses traditional routing and switching protocols. As long as traditional routing and switching protocols are used, there is a risk of being attacked specifically against network equipment, causing serious network security incidents. In particular, if certain special departments are attacked by cyber attacks during special periods, the disastrous consequences caused are immeasurable.

[0003] In the face of emerging network threats, network security equipment needs to be replaced, but the upgrading of equipment will bring many new problems. For example, although it is quite straightforward to install network equipment physically, the installed network equipment must be configured, which requires a high degree of user knowledge and participation. For end users who lack experience in such tasks, troubleshooting may be quite tedious and difficult. These problems seriously affect the transformation of old equipment and the implementation of new technologies. Therefore, a network security equipment deployment method is urgently needed to solve the above problems. Summary of the invention

[0004] The present invention provides a network security device deployment method, which solves the problem that the installed network devices must be configured, which requires a relatively high degree of user knowledge and participation, and troubleshooting may be quite tedious and difficult for end users who lack experience in such tasks.

[0005] In order to achieve the above-mentioned technical features, the purpose of the present invention is achieved as follows: a network security equipment deployment method, including planning and designing the deployment of existing network security equipment, characterized in that: planning and configuring newly commissioned network security equipment, entering network equipment planning information, generating a network equipment configuration table, generating log records for purchased security equipment, formulating detailed implementation plans when implementing cutover, switching or upgrading of running equipment, installing and debugging network equipment, formulating solutions for unexpected emergencies, and there must be a definite cutover rollback time point in the cutover plan. When the cutover is unsuccessful, the cutover personnel will roll back according to the cutover plan on time, and conduct post-rollback testing and verification. After the network security equipment installation is completed, network management personnel will be trained on equipment operation and maintenance.

[0006] Based on the above technical solution, the present invention can also be improved as follows.

[0007] Preferably, in accordance with the principle of convenient management and control, the network is divided into different security domains, and a corresponding address is assigned to each security domain and a default route is set. On the basis of the security domain division, network access control and network resource management and control security controls are conveniently performed, and protection strategies for the boundaries of different security domains are designed in a targeted manner. On the basis of the security domain division, the routing and switching equipment's own capabilities are utilized to divide different security domains of the internal network into different logical subnets according to actual user needs, and access control rules are defined between VLANs to achieve basic isolation between different security domains within the network.

[0008] Based on the above technical solution, the present invention can also be improved as follows.

[0009] Preferably, after the initial implementation of the system is completed, a system trial run is carried out to check whether the implemented security equipment is working properly, record any problems that arise and the process of solving the problems. The main tasks of the trial run phase include: checking and recording the working status of the equipment; discovering problems in actual operation, making timely adjustments, and recording the process and results of solving the problems; checking security policies; and checking the audit and reporting status of each audit device.

[0010] Based on the above technical solution, the present invention can also be improved as follows.

[0011] Preferably, the equipment is installed at the corresponding position of the cabinet in accordance with the cabinet slot layout diagram, and the light-weight equipment is directly installed on the rack. The heavy-weight equipment needs to adjust the installation position of the tray, and the equipment is installed on the rack through the tray.

[0012] Based on the above technical solution, the present invention can also be improved as follows.

[0013] Preferably, the default password of the network security equipment implemented by the project should be changed to a password of more than eight characters, supporting a secure password with a mixture of uppercase and lowercase letters, numbers and characters. The modified password should be formally handed over to the user, who should manage the storage and modification of the password. The management configuration of the device itself should only retain necessary configurations and shut down unnecessary services.

[0014] Based on the above technical solution, the present invention can also be improved as follows.

[0015] Preferably, shutting down unnecessary services includes: shutting down the telnet service and retaining the SSH service for encrypted transmission; after the device configuration is completed, the configuration should be exported and submitted to the customer for backup.

[0016] Based on the above technical solution, the present invention can also be improved as follows.

[0017] Preferably, the cutover time point is selected within a time period of no business data or low business data as a cutover operation window. The network can be disconnected within the window time. Note that the time must be strictly controlled and the network must be opened before the window ends.

[0018] Based on the above technical solution, the present invention can also be improved as follows.

[0019] Preferably, the process of handling unexpected emergencies in a specially defined project is reported by the on-site engineer to the project leader, who communicates with technical experts from all parties involved to arrive at a solution and generate a handling report, which is then archived.

[0020] Based on the above technical solution, the present invention can also be improved as follows.

[0021] Preferably, the order of planning and transformation of network security equipment is to replace and transform the equipment in batches in a manner radiating from core functions to branch functions based on the importance of the equipment functions.

[0022] Based on the above technical solution, the present invention can also be improved as follows.

[0023] Preferably, all configuration scripts are configured in advance on the newly commissioned security equipment, and all cables are laid to the equipment side in advance and labeled. When the window time is reached, you only need to interrupt the connection between the business system and the original network equipment, and open the connection to the newly purchased security equipment at the same time to complete the relevant migration work.

[0024] Beneficial effects of the present invention: 1. The network security device deployment method of the present invention solves the problem that the installed network devices must be configured, which requires a relatively high degree of user knowledge and participation, which may be quite tedious and difficult for end users who lack experience in such tasks to troubleshoot.

[0025] 2. The present invention improves network security by dividing the network into different security domains according to the principle of convenient management and control.

[0026] 3. The present invention conducts a system trial run after the initial implementation of the system, making it convenient for subsequent personnel to inquire about work status and problems.

[0027] 4. The present invention installs the equipment at the corresponding position of the cabinet by comparing with the cabinet slot layout diagram, thereby ensuring the rationality of the equipment layout position.

[0028] 5. Security is improved by setting default passwords for network security devices.

[0029] 6. Reduce the impact of cutover by setting the cutover time point.

[0030] 7. By configuring all configuration scripts in advance on the newly purchased security equipment, you can shorten the network disconnection time and complete most of the preliminary preparations in advance. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0032] Figure 1 It is a flowchart of the present invention.

[0033] Figure 2 It is a schematic diagram of the structure of the present invention.

[0034] Figure 3 This is a diagram of the intermittent operation without business data according to the present invention.

[0035] Figure 4 This is the low business data interval diagram of the present invention. DETAILED DESCRIPTION

[0036] The embodiments of the present invention are further described below in conjunction with the accompanying drawings.

[0037] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0038] Embodiment 1: See also Figure 1-4 A network security equipment deployment method, the invention includes planning and designing the deployment of existing network security equipment, planning and configuring the newly commissioned network security equipment, entering the network equipment planning information, generating a network equipment configuration table, generating log records for the purchased security equipment, formulating a detailed implementation plan when implementing the cutover, switching or upgrading of the running equipment, installing and debugging the network equipment, formulating solutions for unexpected emergencies, and there must be a definite cutover reversal time point in the cutover plan. When the cutover is unsuccessful, the cutover personnel will reversal according to the cutover plan on time, and conduct post-reversal testing and verification. After the network security equipment is installed and implemented, the local network management personnel will be trained on the operation and daily maintenance of the equipment. The network security equipment deployment method solves the problem that the installed network equipment must be configured, which requires a high degree of user knowledge and participation, which may be quite tedious and difficult for end users who lack experience in such tasks to troubleshoot.

[0039] Furthermore, according to the principle of convenient management and control, the network is divided into different security domains, and corresponding addresses and default routes are assigned to each security domain. Based on the security domain division, network access control, network resource management and control and other security controls can be conveniently performed, and protection strategies for the boundaries of different security domains can be designed in a targeted manner. Based on the security domain division, the routing and switching equipment's own capabilities are used to divide different logical subnets for different security domains in the internal network according to actual user needs, and access control rules are defined between VLANs to achieve basic isolation between different security domains within the network. This improves network security.

[0040] Furthermore, after the initial implementation of the system is completed, the system is tested to see if the implemented safety equipment is working properly, and to record any problems that arise and the process of solving them. The main tasks of the test run phase include: checking and recording the working status of the equipment; finding problems in actual operation, making timely adjustments, and recording the process and results of solving the problems; checking security policies; checking the audit and reporting status of each audit device to facilitate subsequent personnel to inquire about work status and problems.

[0041] Furthermore, the cabinet usage specifications, before installing the cabinet, you must check whether the cabinet exhaust equipment is intact, whether the number of equipment pallets is complete, and whether the pulleys and support columns are intact, etc. The cabinet model, specifications, and installation position should meet the design requirements. The vertical deviation of the cabinet installation should not exceed 3mm, and the horizontal error should not exceed 2mm. Several cabinets are placed side by side, and the panels should be on the same plane and parallel to the reference line. The front and rear deviation should not exceed 3mm; the gap between the two cabinets should not exceed 3mm. For equipment that is arranged in a row with a certain distance from each other, the front and rear deviation of the panel should not exceed 5mm. According to the cabinet slot layout diagram, install the equipment to the corresponding position of the cabinet. The lighter equipment of the rack is directly installed on the rack, and the heavier equipment needs to adjust the installation position of the tray. The equipment is installed on the rack through the tray, and the equipment installation position is reasonably planned.

[0042] When the basic workroom does not use a raised floor, a static-conductive floor can be laid. The static-conductive floor can be firmly bonded to the building floor with conductive glue. Its conductive performance should be long-term stable and not easy to generate dust. The raised floor used in the main engine room can be made of steel, aluminum or other flame-retardant materials.

[0043] Furthermore, the default password of the network security equipment implemented by the project should be changed to a password of more than eight characters, supporting a secure password with mixed uppercase and lowercase letters, numbers and characters. The modified password should be formally handed over to the user, who should store and modify the password. The management configuration of the equipment itself should only retain necessary configurations and shut down unnecessary services, such as shutting down the telnet service and retaining the SSH service for encrypted transmission. After the equipment configuration is completed, the configuration should be exported and submitted to the customer for backup, thereby improving security.

[0044] Specifically, refer to Figure 2 For irregular continuous services, since there is no obvious service break, this type of service does not leave a window of time for network disconnection for migration work. However, by comparing with non-continuous services, a cutover time window can be obtained.

[0045] Specifically, refer to Figure 3 The choice of cutover time point is the time period with no business data or low business data as the cutover operation window. The network can be disconnected during the window time. Pay attention to strictly control the time. The network must be opened before the end of the window to reduce the impact of the cutover.

[0046] Specifically, refer to Figure 4 The special process for handling unexpected emergencies in the project is defined, in which the on-site engineer reports to the project leader, who then communicates with technical experts from all parties involved to come up with solutions and generate handling reports, which are then archived.

[0047] The order of planning and transformation of network security equipment should be based on the importance of equipment functions, and the transformation should be carried out in batches in a manner radiating from core functions to branch functions. The System Security Engineering Maturity Model SSE-CMM can be followed during implementation.

[0048] All configuration scripts should be configured in advance on the newly commissioned security equipment, and all cables should be laid out to the equipment side in advance and labeled. When the window time is reached, you only need to interrupt the connection between the business system and the original network equipment, and open the connection to the newly purchased security equipment at the same time to complete the relevant migration work.

Claims

1. A network security device deployment method, comprising planning and designing the deployment of existing network security devices, characterized in that: Plan and configure newly commissioned network security equipment, input network equipment planning information, generate network equipment configuration tables, generate log records for purchased security equipment, formulate detailed implementation plans when cutting over, switching or upgrading running equipment, install and debug network equipment, formulate solutions for unexpected emergencies, and there must be a definite cutover rollback time point in the cutover plan. If the cutover is unsuccessful, the cutover personnel shall roll back according to the cutover plan on time, and conduct post-rollback testing and verification. After the installation and implementation of network security equipment is completed, network management personnel shall be trained on equipment operation and maintenance.

2. A network security device deployment method according to claim 1, characterized in that: In accordance with the principle of convenient management and control, the network is divided into different security domains, and corresponding addresses are assigned to each security domain and default routes are set. On the basis of security domain division, network access control and network resource management and control security controls are conveniently performed, and protection strategies for the boundaries of different security domains are designed in a targeted manner. On the basis of security domain division, the routing and switching equipment's own capabilities are utilized to divide different security domains of the internal network into different logical subnets according to actual user needs, and access control rules are defined between VLANs to achieve basic isolation between different security domains within the network.

3. A network security device deployment method according to claim 1, characterized in that: After the initial implementation of the system is completed, the system is tested to see if the implemented safety equipment is working properly, and to record any problems that arise and the process of solving them. The main tasks of the test run phase include: checking and recording the working status of the equipment; finding problems in actual operation, making timely adjustments, and recording the process and results of solving the problems; checking security policies; and checking the audit and reporting status of each audit device.

4. A network security device deployment method according to claim 1, characterized in that: Refer to the cabinet slot layout diagram and install the equipment to the corresponding position of the cabinet. For rack installation, light-weight equipment can be directly installed on the rack. For heavy-weight equipment, the installation position of the tray needs to be adjusted and the equipment is installed on the rack through the tray.

5. A network security device deployment method according to claim 1, characterized in that: The default password of the network security equipment implemented by the project should be changed to a password of more than eight characters, supporting a secure password with a mixture of uppercase and lowercase letters, numbers and characters. The modified password should be formally handed over to the user, who will be responsible for password storage and modification management. The device's own management configuration should only retain necessary configurations and shut down unnecessary services.

6. A network security device deployment method according to claim 5, characterized in that: The shutting down of unnecessary services includes: shutting down the telnet service and retaining the SSH service for encrypted transmission; after the device configuration is completed, the configuration should be exported and submitted to the customer for backup.

7. A network security device deployment method according to claim 1, characterized in that: The selection of the cutover time point is within the time period of no business data or low business data, which is used as the cutover operation window. The network can be disconnected within the window time. Pay attention to strictly control the time, and the network must be opened before the end of the window.

8. A network security device deployment method according to claim 1, characterized in that: The specially defined process for handling unexpected emergencies in a project is for the on-site engineer to report to the project leader, who then communicates with technical experts from all parties involved to arrive at a solution and generate a handling report, which is then archived.

9. A network security device deployment method according to claim 1, characterized in that: The order of planning and transformation of network security equipment is to replace and transform in batches in a manner radiating from core functions to branch functions based on the importance of the equipment functions.

10. A network security device deployment method according to claim 1, characterized in that: All configuration scripts should be configured in advance on the newly commissioned security equipment, and all cables should be laid out to the equipment side in advance and labeled. When the window time is reached, you only need to interrupt the connection between the business system and the original network equipment, and open the connection to the newly purchased security equipment at the same time to complete the relevant migration work.

Images