* Why NAC appliance vendors don't need to provide a full NAC package
All NAC is divided into three parts: endpoint scanning, enforcement points and policy stores.
The fates of NAC start-ups rests in whether they recognize that it’s not necessary or even desirable to provide all three, according to Rob Whiteley, who tracks NAC technology for Forrester Research.
The way he looks at it, the best shot for NAC start-ups is to sell their gear as an enforcement point, not a turnkey package that includes endpoint scanning and policy as well.
The danger in trying to do all three, he says, is that bigger vendors with more resources, particularly Microsoft, have the ability to provide the endpoint and policy pieces of the puzzle, but they lack an enforcement point. Customers might look to smaller vendors to fill this role, especially if they don’t want to jump on the 802.1x enforcement option that requires upgraded switches.
The start-ups that sell enforcement hardware, such as Caymas, ConSentry, Lockdown, Mirage, Nevis and others, could team up with policy and endpoint scanning partners to get themselves noticed and installed in business networks, Whiteley says.
The idea has some merit. A Texas trucking company that forklifted in a new all-Cisco network infrastructure shunned its NAC scheme in favor of a NAC appliance. Why? Because the architecture required by Cisco NAC meant a more complex VLAN structure than was necessary with the NAC appliance.
Whiteley has a point about NAC appliance vendors not needing to provide a full NAC package. But potential NAC customers should realize that even if a NAC vendor does provide all three NAC elements, they may still be compatible with another vendor’s endpoint scanning or policy engine. This would allow customers to pick and choose what parts to use from each vendor’s gear. In this way customers might have more options than they would otherwise.
Editor’s note: Need to get up to speed on NAC fast? Check out Network World’s NAC Cram Session resource page.
