Guide to Network Access Control
Mapping Your NAC requirements to available NAC productsBy Zeus Kerravala, Network World, 08/13/07
Given all the hype surrounding NAC, it's important to sort through both the capabilities NAC can provide you and the LAN security requirements you have. Different NAC architectures lend themselves to solving different business problems, and ultimately, you need to map your needs to the right architecture.
NAC got its start as an admission control technology, authenticating users and scanning their machines for security compliance before allowing them onto the LAN. And frankly, much of the industry discussion of NAC remains focused on this limited definition of the technology.
But NAC designed as a full network access control solution can do a lot more than simply control who comes onto the LAN. It can help you restrict what people can do after they're already on your LAN - controlling what servers they can reach, what data they can access, and even what applications they can run.
The extent of control you can wield in a NAC solution will depend heavily on its architecture. If all you need is simple guest access control - that is, restricting those who are "not one of us" to the Internet and letting those who are "one of us" go anywhere on the LAN - then a simple, out-of-band architecture can easily meet those needs.
If you need more control, restricting what users can do after they are on the LAN, then investigate inline NAC architectures. Since these devices see all the traffic passing through them, they provide a much stronger baseline for control. How much you'll be able to control is still determined by the feature set of a given vendor. For instance, application understanding is critical to controlling users, but some NAC solutions see applications only via Layer 4 information while others decode applications at Layer 7. The greater the feature set, the greater the control you'll have.
You asked what NAC can and can't do for you. A full-featured access control solution should let you perform the following functions:
* Control who can get onto your LAN and limit what resources they can reach;
* Protect your valuable IP;
* Limit the reach of less-trusted or less-known users, such as contractors, technicians, remote users, or offshore workers;
* Restrict who can access sensitive financial or customer records;
* Control access to data based on role, time of day, location, and application;
* Segment users to meet compliance requirements;
* Protect against known and unknown malware;
* Simplify incident response;
* Protect critical application services such as VoIP
Of course, NAC should not be your only security measure. For example, NAC won't help you with the following tasks:
* Protect information that leaves the premises via e-mail, laptop theft, printouts, or USB storage devices;
* Defend against social engineering;
* Block known malware from entering over the WAN connection;
* Prevent users with authorized access from using data inappropriately
Auditing capabilities in your NAC solution may allow you to find out what files users accessed, so if need be you can demonstrate someone was looking at information not pertinent to his or her job. However, NAC won't prevent that kind of data from leaving your organization.
In summary, other security techniques such as leak prevention technologies and USB lockdown tools will be key to complementing your NAC deployment, but choosing a full-featured solution can give you significant control over who can access what data on your LAN.
Other stories in the Network World archive on point include:
- Users that have gone before you onto the NAC battleground, detail their victories and setbacks. Link to stories at: http://www.networkworld.com/news/2007/020807-nac-rsa.html; http://www.networkworld.com/techinsider/2007/012907-guide-nac.html; http://www.networkworld.com/techinsider/2007/012907-guide-nac-canada.html
- Tim Greene's newsletter advises on how to tweak network mapping parameters to accommodate a NAC deployment. Link to story at: http://www.networkworld.com/newsletters/vpn/2007/0319nac2.html.
- What's the best approach to NAC: In-line or out of band? NWW FaceOff podcast pits Jeff Prince of ConSentry Networks against Grant Hartine of Mirage Network in a debate on the issue. Link to podcast is: http://www.networkworld.com/podcasts/faceoff/2007/012907fo-nac.html