Sneak Peek At Our Third Annual NAC Reader Survey: Page 3 of 4

DRIVERS AND BARRIERS
We asked respondents to identify the top three drivers for their NAC deployments. Compliance is a perennial impetus, at 56%, followed by enforcing control to network resources, at 55%. It's no wonder those two are near the top year over year. In broad terms, two aspects of NAC address compliance: access control and reporting. HIPAA regulations and PCI standards, for example, require IT to enforce access limits and apply controls to computers accessing or hosting sensitive information. The specifics within the regulations are vague, but the intent is clear.

NAC products certainly help enforce access control--at the very least ensuring that guest computers are segregated from the internal network. Systems that use in-band devices create the potential of user- or role-based firewalls to regulate which network devices and services are accessible. This is not to be confused with application access control, which is built into apps and can be fine-grained. Rather, with NAC at the server and service levels, you can set policies so that, for example, only employees can communicate with the HR portal. You don't necessarily need NAC to perform any of these functions, of course, a fact not lost on IT managers. You can get much of the segregation functionality needed to comply with today's security stances using existing technology, though the final result will be somewhat static.

The main barriers to NAC deployments continue to be cost, noted by 61% of respondents in our survey, and complexity, at 54%. Pricing for NAC products starts at $3,000 to $7,000 for software, $10,000 to $20,000 for a low-end appliance, and reaches upward of $50,000 for a high-end appliance. Annual maintenance typically runs 12% to 15% of the purchase price, plus applicable user licenses. Capital costs just to get started are daunting--and we haven't even factored in required network configuration changes or upgrades. It's a hard sell for a technology that doesn't add to the bottom line.

We hear over and over from integrators that they're called in for NAC consultations only after an organization has been successfully attacked. And of course, when you're in panicked reactive mode, it's the worst time to contemplate a technology as invasive as NAC. There are many complexities that organizations face, from simply building the policies that will define how NAC will function to implementing and integrating the chosen system. In addition, NAC products can be complex to install and subsequently modify, especially when they require changes to the physical infrastructure. The lesson: If you're sure NAC is in your future, now may be a good time to make the leap.