Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

NAC: More Is More: Page 7 of 13

"We looked at solutions that would require an upgrade of the infrastructure, and that would be close to 50 percent of our security budget," says a security engineer at a state university. He eventually deployed NAC across five campuses, using standalone products from three different vendors. For the moment, he's avoiding the framework issue because the benefits of multiple enforcement points doesn't justify the extra cost.

We asked how much of the IT infrastructure readers expect to upgrade for a successful NAC deployment. The mean answer was around 30 percent, with deployers expecting to upgrade less than the planners, as shown in "Upgrade Plans," page 78. Just 10 percent of planners said they anticipated no upgrades, with 32 percent expecting not to upgrade more than a quarter of their infrastructure. In contrast, 15 percent of deployers were able to avoid upgrades altogether, with 26 percent upgrading more than a quarter of their infrastructure.

This difference between planners and deployers is probably the result of NAC initiatives that caused less disruption than expected, not because those deploying NAC had more advanced network infrastructures from the start. As mentioned, early adopters tend to be larger organizations, with bigger initial deployment projects. We also asked how much of respondents' networks are 802.1X-capable, and got similar results from both groups: around 54 percent. The main difference is that NAC deployers are more likely to be using this capability, running 802.1X over 33 percent of their networks, compared with 23 percent of nondeployers' networks (those of planners and those with no plans to deploy NAC).

Still, beyond nitty-gritty technical issues and the larger question of future interoperability, upgrading 30 percent of an enterprise's IT infrastructure is a major commitment, no matter how you slice the data. But that commitment is one that an increasing proportion of organizations are willing to make. We were surprised last year by how many respondents were open to significant network changes, and this year the proportion is up slightly among both the deployer and planner groups.

Adding inline appliances or extra enforcement points, such as firewalls, is still the most likely upgrade that sites make to accommodate NAC, but the gap with other architectures is narrowing. Compared with last year, our readers are more willing to add out-of-band appliances, and a lot more willing to upgrade their switching or routing infrastructures.