Despite the security benefits promised by network access control, NAC has yet to be fully embraced. Perhaps it’s the perceived cost, the complexities that troubled early adopters or the plethora of NAC choices available today.
That’s not to say there isn’t enormous interest. After all, a NAC security framework promises to help companies comply with regulations and internal policies, and safeguard resources from evolving threats. (Compare NAC products.)
But which approach is best?
Hardware-based options typically require an appliance that operates either in-line or out-of-band. Some of these appliances displace the access switch; others operate between the access layer and network switches. With either approach, there are many deployment, management and operational considerations.
For example, hardware-based in-line NAC solutions that sit upstream from switches create a potential single point of failure and can be disruptive if they cannot maintain pace with today’s high-speed, 10G network backbones.
Furthermore, in-line NAC solutions may not be ideal for geographically dispersed or highly segmented networks. Not only does there need to be an appliance at every location, but the further up the network the less visibility into network traffic these approaches provide. There’s little sense believing you’re more secure with NAC when you can’t see or stop an intruder’s traffic on a large subnet.
The out-of-band alternative, such as the options that use 802.1x, too often require many network and server configuration changes. They require additional quarantine networks, configuration of ports on each switch as well as access rules to be configured for routers and switches. This not only increases administrative costs, it also increases the risk of error. Clearly, hardware-based NAC isn’t cheap or a panacea.
Next up is the much maligned agent-based approach. No one wants yet another endpoint application to install, update and maintain. It’s not only an additional burden for the IT team but also another catalyst for flurries of help desk calls.
Yet, much can be said in defense of agents. For one, a higher level of scrutiny can be achieved on endpoints, which aids security. And the reality is that agents can be the least disruptive solution available, especially when it comes to network traffic, because agents run quietly in the background, only sending periodic updates to the policy server.
But let’s face it, organizations are not looking for another application to install, no matter how high the security payback may be.
Then there is agentless NAC. A common approach here is to periodically scan endpoints for vulnerability and/or policy assessment, which can place undue traffic stress on busy networks. The scan results are sent to a policy server, and remedial action, if necessary, is taken on noncompliant systems.
While agentless NAC sidesteps the need to install and maintain agents, there’s a compromise: The agentless approach doesn’t provide a persistent way to thoroughly evaluate the status of the endpoint. Also, because identity is ascertained by examining network traffic, users can fool the system.
That brings us to dynamic NAC, which uses agents but only on a percentage of systems. Also known as peer-to-peer NAC, this approach doesn’t require network changes or software to be installed on every system.
The agents, some of which become enforcers, are installed on trusted systems and, much like a police force, you need only a small ratio of law enforcement to the general population to make certain everyone is in compliance. In this way, it’s possible to attain the high levels of security associated with agents and all of the benefits of NAC without the hassles of hardware-based NAC or software on every device.
Suppose a number of enforcers are installed on desktops within a LAN and an untrusted system attempts to log on. The enforcers will detect and restrict the newcomer’s network traffic by using Layer 2 link protocols until the newcomer has been vetted. And these agents communicate continuously with the central policy server about what remediation (if any) is necessary. So a system could be fully quarantined or blocked from certain network segments, or only allowed Internet access.
Despite the fact that NAC is facing a level of resistance in the marketplace as a result of some less-than-spectacular deployments, it’s more crucial than ever that NAC be examined. Not only have there been recent advances in NAC solutions, but the increasingly mobile computing environment demands the proactive nature of NAC-enabled security.
It’s a sure bet that smartphones and other handheld computing devices will be moving onto your network. They’ll add to the already daunting challenge of making sure all of your systems remain compliant and secure.
That’s the bad news. The good news? There are dynamic NAC solutions available to make certain your network is operating securely and within policy.
Lum is CEO of InfoExpress. He can be reached at lum@infoexpress.com.
