Wedded bliss: NAC and identity management

The CIO-level business angle on the latest tech

Network access control is one of those technology categories that has a lot of promise but not a lot of users, despite the fact that solutions have been available for years. There can be significant challenges to deploying an enterprise solution. For example, creating the policies that provide just the right level of security without being overly aggressive isn't easy. Also, it's difficult to find a solution that fits into a multi-vendor infrastructure, both on the network as well as the client side.

In 2006, a couple of veteran engineers from Cisco started a company to address those very issues that seemed to be holding customers back from deploying NAC. This was the birth of Avenda Systems and its multifunction platform for network access security. A design goal from the outset was to make sure Avenda's solution would work in any environment, regardless of network infrastructure, endpoint devices and identity stores.

Avenda's eTIPS appliance sits at the crossroads of traditional NAC and the identity management space. Traditional NAC typically focuses on remediating endpoint health problems before allowing a device to connect to the network. Identity management is a popular concept using identity-based policies to determine user access permissions. Avenda marries the identity information and the physical device information to provide a very granular set of access conditions.

Differentiated access based on role can be granted for employees, partners, contract or temporary workers, and guests to limit and control where on the network each group has access. Employees can be granted full network access privileges based on their job or group while guests may only be granted access to the Internet. Granular access privileges also can be granted based on type and health of endpoint, location, time of day and more. For example, an employee at a desktop may have access to more sensitive data than when connected to the network via a smartphone over a public VPN. Or in a hospital, a medical cart that gets plugged into the network can be given access only when it's on a specific floor or wing. To limit virus and malware attacks, endpoint integrity or health checks can be triggered to ensure that users are using required antivirus, antispyware and firewall applications.

To continue reading, register here to become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Network access control is one of those technology categories that has a lot of promise but not a lot of users, despite the fact that solutions have been available for years. There can be significant challenges to deploying an enterprise solution. For example, creating the policies that provide just the right level of security without being overly aggressive isn't easy. Also, it's difficult to find a solution that fits into a multi-vendor infrastructure, both on the network as well as the client side.

In 2006, a couple of veteran engineers from Cisco started a company to address those very issues that seemed to be holding customers back from deploying NAC. This was the birth of Avenda Systems and its multifunction platform for network access security. A design goal from the outset was to make sure Avenda's solution would work in any environment, regardless of network infrastructure, endpoint devices and identity stores.

Avenda's eTIPS appliance sits at the crossroads of traditional NAC and the identity management space. Traditional NAC typically focuses on remediating endpoint health problems before allowing a device to connect to the network. Identity management is a popular concept using identity-based policies to determine user access permissions. Avenda marries the identity information and the physical device information to provide a very granular set of access conditions.

Differentiated access based on role can be granted for employees, partners, contract or temporary workers, and guests to limit and control where on the network each group has access. Employees can be granted full network access privileges based on their job or group while guests may only be granted access to the Internet. Granular access privileges also can be granted based on type and health of endpoint, location, time of day and more. For example, an employee at a desktop may have access to more sensitive data than when connected to the network via a smartphone over a public VPN. Or in a hospital, a medical cart that gets plugged into the network can be given access only when it's on a specific floor or wing. To limit virus and malware attacks, endpoint integrity or health checks can be triggered to ensure that users are using required antivirus, antispyware and firewall applications.

You can use a full agent or a dissolvable agent on the endpoint devices to run a check to determine the health of each device. The agent reports back to the policy engine, which determines if the access requirements have been met. Once the check is complete, the agent can simply dissolve off the device.

Avenda uses the concept of policy building blocks to speed up the policy creation process. The elements of a policy are very definable; for example, authentication methods, authentication sources, internal posture, external posture and so on. Once you build a policy building block and populate it with the information you need for a particular service (such as your wired network), you can reuse the building block when you add additional services (such as a wireless network or VPN access). There are preconfigured templates that give you a starting point for your policies.

Linda Musthaler is a principal analyst with Essential Solutions Corporation.