Network access control is one of those technology categories that has a lot of promise but not a lot of users, despite the fact that solutions have been available for years. There can be significant challenges to deploying an enterprise solution. For example, creating the policies that provide just the right level of security without being overly aggressive isn't easy. Also, it's difficult to find a solution that fits into a multi-vendor infrastructure, both on the network as well as the client side.

In 2006, a couple of veteran engineers from Cisco started a company to address those very issues that seemed to be holding customers back from deploying NAC. This was the birth of Avenda Systems and its multifunction platform for network access security. A design goal from the outset was to make sure Avenda's solution would work in any environment, regardless of network infrastructure, endpoint devices and identity stores.

Avenda's eTIPS appliance sits at the crossroads of traditional NAC and the identity management space. Traditional NAC typically focuses on remediating endpoint health problems before allowing a device to connect to the network. Identity management is a popular concept using identity-based policies to determine user access permissions. Avenda marries the identity information and the physical device information to provide a very granular set of access conditions.

Differentiated access based on role can be granted for employees, partners, contract or temporary workers, and guests to limit and control where on the network each group has access. Employees can be granted full network access privileges based on their job or group while guests may only be granted access to the Internet. Granular access privileges also can be granted based on type and health of endpoint, location, time of day and more. For example, an employee at a desktop may have access to more sensitive data than when connected to the network via a smartphone over a public VPN. Or in a hospital, a medical cart that gets plugged into the network can be given access only when it's on a specific floor or wing. To limit virus and malware attacks, endpoint integrity or health checks can be triggered to ensure that users are using required antivirus, antispyware and firewall applications.

Linda Musthaler is a principal analyst with Essential Solutions Corporation.