Identifying endpoints

NAC can use many factors in deciding whether to allow a particular device access to a network, and users have definite preferences for some over others, according to a recent study.

The most popular method of identifying endpoints is by linking them to a user’s identity, according to an Aberdeen Group report based on a survey of more than 120 companies, only 28% of which currently use NAC. Respondents were allowed to choose more than one response.

The study says 67% of those who responded wanted some sort of authentication that ensured that the NAC system could determine who was operating the machine that was trying to connect. This is the key factor in determining access rights, so it makes sense that this would be important to anyone setting NAC policies.

Second on the list with 60% was the access method being used by the device, such as LAN connection, SSL VPN, IPSec VPN or wireless. These methods might inspire different levels of trust, so policies might be geared to them. A machine connecting on the LAN, for example, might be given access to more sensitive data than, say, one connecting via an SSL VPN.

Endpoint type was third with 46% of respondents saying it was of importance. It mattered to them whether the device attempting to connect was a printer or a laptop or a desktop. Each has a different threat potential to the network and therefore knowing what type it is can help determine under what circumstances it ought to be allowed access.

The fourth method of identifying endpoints was their physical location, an option chosen by 21% of respondents. A device on the corporate LAN might be more trusted than one at a user’s house or one at an airport wireless hot spot where someone might be peeking over the shoulder of the user.