* Effective NAC policies must meet both security and business needs
It’s important to remember that if NAC becomes a hindrance in networks it becomes a bad investment that gets blamed for preventing employees from doing their jobs.
There is of course the argument that, in particular, NAC should never prevent the CEO from gaining network access, so it may make sense to make the boss a special case.
But in terms of being friendly to the everyday business of a company, NAC must not slow down the legitimate work lower-level employees are trying to do to produce success.
NAC policies network executives choose to implement go a long way toward determining how intrusive NAC becomes. If a the absolute latest antivirus (Compare antivirus products) signatures are a policy must, then the business must have an efficient and effective means to update them, preferably not while end users are trying to get NAC checks over with so they can do some work.
Allowing individual machines to lag behind in installing new signatures can ease the problem, but requires a risk assessment. Is it worth the potential annoyance of updating signatures while end users wait? It is an issue all those deploying NAC must consider. Even auto-remediation that requires little manual effort by end users causes them to wait, and that can become a significant problem.
Similarly, ongoing assessment of end-users behavior and policies that can lead them to losing access based on what they are doing on the network need to be carefully thought out. The range of misbehavior – and the fact that it could be unintentional or misinformed as opposed to malicious – must be thought out carefully as policies are designed.
Warning users that their behavior is suspect with a pop-up window may be a better idea than kicking them off the network, depending on the detected infraction.
The bottom line is that setting up effective NAC policies that meet both security and business needs is a major task on the list of what needs to be done to bring about an effective deployment. And it requires input not just from the IT desktop, network and security teams, but from business-side leaders as well. (Compare NAC products)
