* Intel improves desktop security with NAC
New chips from Intel support Cisco’s NAC. The vPro microprocessors can store certificates for 802.1x authentication, which can be a component of Cisco’s NAC, as well as storing information needed by Cisco’s NAC to determine whether a device complies with security policies.
Specifically, Cisco NAC seeks to know things such as whether a device has an updated operating system or updated virus libraries. It uses this information to determine whether the device is safe enough to let onto the network, with a reasonable degree of assurance that the machine is not infected.
This checking is generally done either with no specialized software on the end machine – which allows rudimentary endpoint checking – or via software or dissolvable software agents.
The problem with software doing the checks is that the machines are essentially reporting on themselves, a well-known weakness in security architecture. If the end machine is compromised, it might be compromised to the extent that it can lie effectively to the NAC policy engine.
The generally accepted better method is to have the endpoint check done in hardware, which is what the new chips support. Cisco NAC posture can be stored in the chips themselves.
This makes endpoint checks available even if the hardware is powered down or if the operating system is compromised. The chips also can receive updates for software on the host computers, so the chips could become part of remedying shortcomings that a NAC check reveals.
These new features are something that should be kept in mind as businesses update their computers and if they are weighing whether Cisco NAC is the way to go.
