* Will PERM replace NAC?
A study by Forrester Research declares an end to NAC as we know it.
More specifically, “today’s approach to NAC will fail,” according to the report “Client Management 2.0,” written principally by analysts Natalie Lambert and Rob Whiteley.
Their bottom line is that something new, which they call proactive endpoint risk management or PERM, will take the place of NAC.
PERM is: “Policy-based software technology that manage risk by integrating endpoint security, access control, identity and configuration management.”
Lambert and Whiteley even point to some specific vendors working on software that they say will fall under PERM – McAfee, Microsoft, Symantec and Cisco.
The report makes several good points, but it probably overstates the case that NAC will die. More likely it will evolve to address some legitimate shortcomings, the report points out.
It says NAC is too complex, too fragmented and too focused on known threats, not new ones.
It is complex. The most ambitious NAC architectures call for checking whether endpoints meet security policies, updating device configuration to meet policies, enforcing what level of access should be granted and checking for and isolating endpoints and users that have made it onto the network yet seem to be breaching security policies or at least trying to.
A big problem with that is some of these elements are managed by separate platforms and even the same element may be managed by different platforms depending on how a device accesses the network.
The example used in the report is that a policy for virus definitions to be updated has to be expressed in different places for enforcement by different devices for different users. For remote users, the policies would be expressed for and enforced by a VPN gateway, perhaps, and for a LAN user, expressed for and enforced by a switch.
Software that enables a central place for creating and storing policies once, that can be enforced many places, is core to PERM, the study says.
Another way to look at it is that vendors are working on software that accomplishes the many goals of NAC in a way that is simpler to set up and manage.
Whether PERM is a new entity or just another way to talk about the evolution of NAC, it is the inevitable direction NAC will go.
