Network Computingwww.networkcomputing.com

Tutorial: Network Access Control (NAC)

Posted by
July 17, 2007

Tags: 802.1X, AR, Access Requestor, Cisco, Microsoft, Mike Fratto, PDP, PEP, Policy Decision Point, Policy Enforcement Point, Trusted Computing Group Trusted Network Connect, inline NAC, network access control, out-of-band NAC, tutorial, Access Control, Client/Server Protection, Data Center Access, Data Networking & Management, Data Protection, Infrastructure, Internet Authentication , LAN Access, NAC, Network Security, Security and Privacy

Channel: Networking & Mgmt, Data Protection

No network is airtight—malware continues to get in, whether via mobile employees, guest or contractor laptops, or end users downloading dodgy content. Antivirus software at the gateway or on the desktop helps with computers under your control, but guests and unmanaged servers remain problematic. And let's face it: Sometimes attackers are just smarter than we are. Even companies following best practices get hit.

We don't just mean just security best practices, either. Protecting the network from malicious hosts is, ultimately, a desktop management function. NAC is what puts teeth in your policies, providing an enforcement mechanism that helps ensure computers are properly configured. By weighing such factors as whether a user is logged in; her computer's patch level; and if anti-malware or desktop firewall software is installed, running and current, IT can decide whether to limit access to network resources based on condition. A host that doesn't comply with your defined policy could be directed to remediation servers, or put on a guest VLAN.

Remember Slammer? If a company could have determined that a host was running an unpatched version of MSDE 2000 and denied access until it was patched, Slammer would have had a much less dramatic effect.

That's the promise, but NAC is no magic bullet. The solution to the Slammer scenario is to either patch the vulnerable system when you can, or remove access to MSDE from the network. But if your NAC system doesn't check for applications like MSDE or their patch levels, it wouldn't preclude a vulnerable node from accessing the network.

Related Reading

---

More data-protection Insights