* NAC not a complete answer for complying with any regulation
A reader responding to the last newsletter about how NAC might help meet certain regulatory requirements asked how that might work.
The reader wrote: “I do not see how a machine that is running a firewall, is fully patched and is running a current [antivirus] product applies to any of the regulatory or compliance laws like SOX, GBLA, HIPAA, PCI or FRCP.”
First off, just to be clear, NAC is not a complete answer for complying with any particular set of regulations. Most compliance plans are pieced together using a range of security, recording, reporting and auditing technologies.
But one NAC customer says he uses NAC at least in part to help meet some of the obligations HIPAA places on his business. He says he relies on it to identify individuals logging in and linking those identities to a machine to have better assurance that it really is an authorized user accessing sensitive patient information.
In addition the NAC gear grants individuals access only to VLANs specified by NAC policy rules. This arrangement enables his business to control what resources users have access to. Only people who absolutely need to access sensitive data to perform their jobs get access to it. The NAC gear enforces this for LAN-attached machines as well as those accessing via a VPN used by employees working remotely.
All of this is useful in demonstrating to regulators that his business is maintaining the confidentiality of patient data, he says, and has come in useful in demonstrating compliance during security audits.
So NAC can be a useful tool in complying with regulations when mixed in with a strong, overall security strategy.
