Cisco’s NAC can be fooled into thinking non-compliant PCs actually meet the security posture NAC is designed to enforce, according to security experts reporting at the Black Hat conference in Europe.

That means Cisco’s NAC could admit non-compliant PCs to networks because it can’t tell that it is being lied to.

So if a PC tells Cisco’s NAC policy server what it needs to hear - that its personal firewall settings are proper; and its antivirus is updated to a certain point; and its operating system is patched to a set level - it will admit the device. Cisco’s NAC will not know that the data is phony.

Cisco’s response is that such deceptions are possible, but Cisco NAC still authenticates users. So while Cisco NAC might admit unqualified machines to networks, it can only be duped by someone who can also successfully authenticate the machines to the NAC policy server.

Carrying out this type of ruse is complicated. For instance, a person has to know the proper posture information to pass up to Cisco’s NAC policy server in order to successfully fool it. If the PCs antivirus software must have been updated to a certain signature release from a certain vendor, the person behind the deception has to know that information in order to succeed.

The Black Hat presentation addresses only Cisco NAC, not other NAC endpoint-checking schemes, and they may be similarly vulnerable.

Security experts say one point to take a way from this is that as a matter of course it is ill advised for devices to report on their own state for just this reason.

Endpoint checking has always had its shortcomings. Even if the device doesn’t lie to the policy server, the information it assesses can’t prove that the device is safe to admit to the network. It can only indicate that it is less likely to infect the network.

The demonstration of this weakness makes endpoint checking in the Cisco environment less useful.

Tim Greene is senior editor at Network World.