Burning NAC questions - Part 1

Part 1 of 2. Network-access control still has a way to go before it becomes a standard component of network security in most companies, but signs of growth are there, with vendors predicted to sell $629 million in NAC enforcement appliances by 2010, according to Infonetics. In the meantime, for those who are undecided whether to jump into the NAC frenzy here are the answers to some important NAC issues.

See part two: Shouldn’t I just wait for Cisco? Should I deploy NAC in-band or out-of-band? What is the best method of enforcing NAC policies?

Who needs NAC anyway?

Will NAC help meet regulatory compliance?

Shouldn’t I just wait for Microsoft?

Who needs NAC anyway?

The short answer is anybody who wants to check whether a machine meets a configuration health check before it is allowed on the network and anybody who wants the ability to restrict access rights if the machine violates policies after it is admitted.

Passing the health test doesn’t mean the machine is free of infections that can cause harm to the network, but it helps reduce the chances that the machine will cause trouble.

So far colleges and health facilities have embraced this aspect of NAC more so than other businesses because they both have large populations of users with mobile devices that attach, disconnect and reattach to networks. NAC helps give some assurance that these devices have maintained a sound security posture while disconnected.

The primary thing NAC does is decide which hosts are allowed to attach to networks and stay there. The criteria for making these decisions can vary widely, from a having a media access control address that is on a white list to passing a health check that looks for a range of parameters. These can include such factors as an updated antivirus software that is running a patched operating system, required registry settings and a properly configured personal firewall to name a few.

The criteria can also include whether a device remains in a healthy state and whether it behaves properly once it is admitted to the network.

The hope is this admission control will prevent machines that might have been compromised from contaminating networks with malware and from pilfering data. Mobile devices and devices brought onto networks by visitors and consultants are examples of potentially threatening machines.