Despite the security benefits promised by network access control, NAC has yet to be fully embraced. Perhaps it’s the perceived cost, the complexities that troubled early adopters or the plethora of NAC choices available today.

That’s not to say there isn’t enormous interest. After all, a NAC security framework promises to help companies comply with regulations and internal policies, and safeguard resources from evolving threats. (Compare NAC products.)

But which approach is best?

Hardware-based options typically require an appliance that operates either in-line or out-of-band. Some of these appliances displace the access switch; others operate between the access layer and network switches. With either approach, there are many deployment, management and operational considerations.

For example, hardware-based in-line NAC solutions that sit upstream from switches create a potential single point of failure and can be disruptive if they cannot maintain pace with today’s high-speed, 10G network backbones.

Click to see: Diagram of nac

Furthermore, in-line NAC solutions may not be ideal for geographically dispersed or highly segmented networks. Not only does there need to be an appliance at every location, but the further up the network the less visibility into network traffic these approaches provide. There’s little sense believing you’re more secure with NAC when you can’t see or stop an intruder’s traffic on a large subnet.

The out-of-band alternative, such as the options that use 802.1x, too often require many network and server configuration changes. They require additional quarantine networks, configuration of ports on each switch as well as access rules to be configured for routers and switches. This not only increases administrative costs, it also increases the risk of error. Clearly, hardware-based NAC isn’t cheap or a panacea.

Next up is the much maligned agent-based approach. No one wants yet another endpoint application to install, update and maintain. It’s not only an additional burden for the IT team but also another catalyst for flurries of help desk calls.

Yet, much can be said in defense of agents. For one, a higher level of scrutiny can be achieved on endpoints, which aids security. And the reality is that agents can be the least disruptive solution available, especially when it comes to network traffic, because agents run quietly in the background, only sending periodic updates to the policy server.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports