* Microsoft's plans to protect remote access VPNs with NAP
One of the first things Microsoft says it will do with its recently announced Network Access Protection, or NAP, is to protect remote access VPNs.
It is good to protect the remote end of VPN connections because these machines are remote network nodes and malicious code entering there could infect an entire network.
It’s such a good idea that VPN vendors have already thought of it and enlisted the help of other security tools providers to make sure the remote machines have specified anti-virus software, appropriate operating system patches and a range of other parameters in place before the machine can establish a VPN tie to the network at large.
NAP promises to sit in the middle of this process and help out. Rather than using another vendor’s client software on the remote machine, the client software would be part of a Windows operating system, already installed and ready to configure. And rather than using another vendor’s server in the network to handle the security policies, the policies would be handled by Microsoft servers.
In the isolated case of protecting the VPN endpoint, it might make more sense to use the endpoint protection provided by the VPN vendor because it exists today and the bugs have been worked out. In the case of protecting multiple kinds of endpoints, not just remote access VPN machines, it may make sense to use NAP. Eventually.
NAP is based on Microsoft publishing APIs that will allow other vendors to write software so their products fit into the Microsoft scheme. This potentially gives NAP broad implications, but it will require the cooperation, work and time of many other vendors. So, for now, NAP is a work in progress.
It’s good to be working on a broad architecture that can protect networks, but remember all that’s been announced is that the practical means to take the first steps are coming later this year. There is a lot of time yet before NAP can become the tool that binds together network access security. In the meantime, it’s probably sound to shop for existing products that meet your needs than to wait for NAP.
