18/06/2012
Few would argue that network access control doesn't improve security. NAC quickly vets users from those systems who shouldn't be granted access, and it makes sure that crucial policies such as firewall settings, anti-virus and patch levels are up-to-date. When done right, NAC creates a network with traffic flows clean of malware infections and many other risks associated with security breaches.
The catch? Yes, there's always a catch: Many NAC solutions have proven to be expensive to deploy and manage. In this article, we'll tell you what you need to know to determine the best NAC option for your type of environment. But, before we get into that, we need to quickly recap the four primary types of NAC solutions:
1. Hardware-based NAC. Whether in-line or out-of-band, these options typically require that an appliance be installed at almost every location where NAC will be enabled. Some of these appliances displace the access switch, while others operate between the access layer and network switches.
2. Agent-based software NAC. Next up is the agent-based approach. Here, agents are installed on each NAC-enabled device. These agents scan and monitor the device, typically sending the results back to a centralized server. Systems found to be out of compliance are not granted access, and are often sent for some type of remedial action.
3. Agentless software NAC. Agentless NAC, which consists of a dissolvable agent, is another common approach. With this setup, the idea is for a temporary agent—usually some type of ActiveX control—to scan endpoints periodically for vulnerability and/or policy assessments. The scan results are sent to a policy server, and remedial action, if necessary, is taken on noncompliant systems. When the process is complete, the temporary agent dissolves.
4. Dynamic NAC. That brings us to dynamic NAC, which uses agents but only on a percentage of systems. Also known as peer-to-peer NAC, this approach doesn't require network changes or software to be installed on every system. The agents, some of which become enforcers, are installed on trusted systems. Then, similar to a police force, you need only a small ratio of law enforcement to the general population to make certain everyone is in compliance.
Whether you select hardware, software, agentless or dynamic NAC, you need to consider the goals of your NAC deployment such as the level of security versus manageability, as well as other facets that depend on the size of your business and network.
NAC and geographically dispersed networks
With a large network, there are many deployment, management and operational considerations. For example, hardware-based, in-line NAC solutions that sit upstream from switches create a potential single point of failure. They can be disruptive if they cannot keep pace with today's high-speed 10G network backbones.
Furthermore, in-line NAC solutions may not be ideal for geographically dispersed or highly segmented networks. Not only does there need to be an appliance at every location but the further up the network, the less visibility into network traffic these approaches provide.
There's little sense believing you're more secure with NAC when you can't see or stop an intruder's traffic on a large subnet. The out-of-band alternatives, such as the options that use 802.1x, too often require many network and server configuration changes. They require additional quarantine networks and configuration of ports on each switch, as well as access rules to be configured for routers and switches. This not only increases administrative costs, it also increases the risk of error. Clearly, hardware-based NAC isn't cheap or a panacea.
But hardware-based NAC can provide high levels of security and, because they focus on network traffic, can find exploits traveling across the wire.
With software-based approaches in geographically dispersed networks, manageability challenges remain but are now moved to the endpoints—which will require software agents to be installed on each. While the agentless NAC approach may alleviate some of this management burden, agentless NAC doesn't provide a consistent way to thoroughly evaluate the status of the endpoint—which means there’s a significant security versus manageability trade-off.
Because dynamic NAC enlists only a certain percentage of systems as security enforcers, dynamic NAC actually could help you leverage the power of the distributed network to protect itself.
