* Some must-dos for NAC comparison testing
Anyone deploying NAC needs to test the products they are considering, and here are a few must-do tests for comparison.
The tests should hit the four basic functions of NAC – authentication; assessing endpoint posture; enforcing NAC policy; and management.
Evaluating NAC gear depends on the size of the network in which it will be deployed, so if it’s a small network, the on-board authentication may suffice if it’s not too much trouble to enter the authentication directories. Integration with RADIUS servers is key for larger networks with LDAP or Active Directory. Such integration is key for large numbers of users.
Endpoint assessment should also be tailored to the particular customer network. Depending on how much data must be collected from the end machines, the NAC agents will need to integrate with other client software to a greater or lesser degree. An agent integrated with an endpoint security suite will generate more specific data than a clientless NAC deployment, for instance. If only basic factors about the endpoint will be used to set the NAC policy, then the clientless platform may do.
There is a broad range of enforcement mechanisms in NAC, and again, the one chosen should match need. If NAC is a simple toggle switch to allow access or deny it, enforcement can be relatively simple. If a complicated set of factors such as access method, type of machine and user role are all considered, an enforcement platform with granular capabilities is called for.
NAC management must scale to its environment as well. It should include partitioning so different types of administrators – network, security, desktop – can each have their own level of access. Platforms should be chosen that can readily generate reports needed for upper management or compliance audits. And they should adequately trigger alerts when violations are detected.
Potential customers should check out each of these factors – at least – when evaluating NAC gear. If vendors tell you their gear meets your needs, check it out anyway.
