NAC 2.0: A new model for a more secure future

NAC’s functions fit better on the endpoint. Weincludes the experts on:
need to move beyond today’s scenario, whereSwitching
users struggle to implement NAC as a successfulVirtual (VLAN) management
security framework. Just how bad is it? We’veRouting IP address management.
found that 40% of enterprises surveyed had begunThe network team is responsible for ensuring network
NAC deployments, but only 4% actually finished.availability and performance. It does not typically have
The majority of those that do finish are turning toany responsibility for endpoint assessment and
solutions focused on network hardware like appliances,remediation and does not care what the configuration
Ethernet switches, routers, and VPN gateways. Butof any particular endpoint computer is. Its concern in
we believe this is the wrong approach.terms of the endpoint is to supply the appropriate level
NAC 1.0 and why it failedof service to a computer based on its role and
Organizations are increasingly turning to networkcompliance state.
access control technologies to provide betterNAC and the network team
protection for their networks and data. However,The network team needs NAC to keep unknown or
many of the first generation “NAC 1.0” solutionsunsafe computers from impacting network security,
were based on an inherently flawed model that failedavailability, and performance.
to respect the expertise and ownership of differentNAC needs the network team to manage the switch
groups in the organization. NAC 1.0 was also unable tofabric for enforcement (VLANs, access control lists)
react quickly enough to protect against rapidly evolvingbased on compliance state.
threats or to support the needs of an increasinglyDesktop team
mobile workforce.The desktop team is concerned with managed
NAC 1.0 – fundamentally disconnected NAC 1.0computers and all aspects of their configuration –
suffered a disconnect in perceived ownership, with aeven when they are not connected to the network,
struggle for control between the two key teams whofor example, while roaming.
brought two distinctive perspectives:The team drives the requirements for assessment of
The network team’s perspective – guestendpoint configuration, remediation of any
access. The network team interpreted “networkmisconfiguration, and patching and updating, including:
access control” as meaning a way to control orSelection, management, and updating of antimalware
block unauthorized access to the network.software and desktop firewall
The desktop team’s perspective – managedDesktop patch management
endpoint computers. The desktop team sawImplementation of best practices for secure
“network access control” as meaning a way toconfiguration.
control or ensure the security and productivity ofNAC 2.0: A new model for a more secure future
users’ computers.NAC and the desktop team
NAC 1.0 – focusing on blocking guestsThe desktop team needs NAC as a tool to eliminate
Guest access was an easy target for many earlyconfiguration drift on the computers under its control
NAC 1.0 products, with access generally seen as aregardless of network location.
luxury rather than a business necessity, and oftenNAC needs the desktop team to define ideal
needed only in specific locations such as conferenceconfigurations and remediation mechanisms.
rooms. In addition, guests often do not have a formalSecurity team
relationship with the business and are not part of anyThe security team is focused on regulatory
of the organization’s identity management systemscompliance and audit. Although it does not have dayto-
such as Microsoft Active Directory. It was fairly simpleday operational responsibility for desktops and the
for many pointsolution appliances to provide anetwork, it sets the standards for compliance
mechanism to block guests’ computers until theythroughout the organization. Some practices are
could be made compliant with the organization’smandated by government regulatory bodies, such as
security policies. However, this NAC 1.0 focus onHIPAA (USA)3, PIPEDA (CA)4, and BS7799
meeting the network team’s goal of controllingISO27002 (UK/Int’l)5, while some come from
guest access missed a far greater problem in termsrecognized industry bodies, such as the Center for
of an organization’s security, namely the muchInternet Security (CIS Benchmarks)6 and the Payment
greater likelihood of devastating data loss from aCard Industry (PCI DSS)7.
misconfigured managed endpoint computer. With aIn addition to its already formidable responsibility for risk
few exceptions, such as higher education, the sheermanagement, the security team is responsible for:
number of managed endpoint computers means theyDetermining which standards are applicable in their
present a much greater threat surface making them inorganization
reality a much greater risk.Auditing the environment against those
NAC 1.0 – lacking agilityStandards
First-generation NAC solutions failed to recognize thatShowing proof of standards compliance.
the threat environment is constantly changing,with newNAC and the security team
threats and vulnerabilities appearing every day.The security team needs NAC to minimize the risk
Anti-malware vendors release a steady stream offrom non-compliant, unknown, and unsafe computers
updates to detect and clean new threats. Operatingand to provide comprehensive reporting and audit.
systems and applications vendors issue securityNAC needs the security team to define standards for
patches on a daily basis.regulatory compliance and security best practices.
NAC 2.0: A new model for a more secure futureNAC 2.0 – focusing on business goals
Many NAC products could not easily be updated toUnlike one-size-fits-all NAC solutions, NAC 2.0
allow for the latest updates. When an antimalwarerecognizes that businesses have different goals for
vendor released a new update or a new version, theemployees, contractors, and guests, and, when
administrator often had to update the assessmentproperly implemented, focuses on the requirements for
rules manually. With new operating system patches,each group.
administrators typically had to enter a new, complexBusiness goals for employees
set of registry entries corresponding to each newEnable – not block – access to the network and
patch for each operating system – if the NAC toolsapplications
supported patch assessment at all. The large effortEnhance productivity, security and compliance.
required to keep rules up to date meant that NACBusiness goals for formal visitors, such as contractors,
assessment tools lagged far behind the real dangerspartners, and consultants
facing organizations.Assess the level of risk posed by the unmanaged
Early mistakescomputers of these visitors.
Intrusion Prevention SystemsProvide restricted access appropriate to the
Some early NAC products were based on Intrusionauthorization and level of risk.
Prevention Systems (IPS) that looked for anomalousBusiness goals for informal guests and unknown
network behavior. These were useful when threatscomputers
often consisted of worms with identifiable networkRequire proof of authorization
signatures. Today’s threats are frequently invisibleBlock network access unless authorized.
to behavior-based IPS in which case there will be noMany NAC project failures have been a result of too
identifiable network anomaly.great a vendor focus on the network enforcement
Network appliancesmechanisms, and not enough on the practical
Some NAC vendors chose to deliver their solutions asprioritization of achievable business benefits against
network appliances. This was a choice madefor theireach distinct use case. Successful NAC deployments
own convenience, not their customers’ needs. Byhave in common the primary objective of enabling
delivering as an appliance, the vendors were able tosafe access to appropriate resources by authorized
limit their testing to a small set of predeterminedpeople – and not an objective of blocking users
platforms. This seeming convenience is deceptive.from the network. In other words, NAC 2.0 focuses on
Networks often had to be redesigned to insert anenabling rather than blocking access.
appliance, funneling all traffic through a choke point andSecurity team
affecting performance and reliability. NAC appliancesNAC 2.0: A new model for a more secure future
also lack deep assessment capabilities, good scalability,NAC 2.0 – providing dynamic flexibility
and the means to protect computers when they areIT departments now have available a much richer
not connected to the network.context in which to make decisions about authorizing
Network equipmentaccess to company resources. In determining the
Network vendors are typically interested in upgradingappropriate level of access, they can now go beyond
switching and routing gear to include the latestsimple user identity and role, and consider machine
features. They do not have a good presence on theidentity, access location, access method, time of
endpoint and as a result attempts to control networkaccess, device security posture and state, emerging
access with equipment alone were unsuccessful as itthreats and available threat responses. The resulting
offered weak assessment and little or no policyauthorization policies are dependent on increasingly
management. Networkbased NAC ignored the issuerapid real-time information about security updates.
of remote or roaming users, although ironically NACDeciding if a computer is fully patched requires
has its roots in Host Integrity Checking for roamingup-to-date knowledge of available security patches.
users.Knowing if a guest computer’s anti-malware
NAC Frameworksprotection is current means the system must not only
The original NAC Frameworks – such as Microsoftknow about a company’s own chosen anti-virus
Network Access Protection (NAP), Cisco Networkproduct, but also understand what threat detection
Admission Control (NAC), and Trusted Computingupdates have been published by each anti-virus
Group’s Trusted Network Connect (TNC) –vendor at all times. Knowledge of the emerging threats
offered basic interoperation standards and little more.and available responses are both key to making
They provided some plumbing, but left organizations toauthorization decisions and therefore, NAC needs to
do the work of fitting it all together. Policyhave the native capability to provide this critical stream
management, updating, and audit were left out of theof information.
equation.Today’s best endpoint NAC solutions are evolving
There was also a critical flaw in the NAC Frameworksto enable effective management and control ofaccess
reliance on a “trust” model – selfpolicing byauthorization by providing two distinct sets of
the very applications that have gone wrong. Theycapabilities:
required anti-malware software to report its ownNetwork enforcement mechanisms that provide an
status, even though a failure in that software might beentry gate onto the network, alongwith the ability to
the very reason a computer was unprotected.restrict access using dynamic VLAN and/or ACL
Furthermore, unwanted and unauthorized software,assignments, delivered (unlike the special-purpose
such as spyware or peer-topeer applications, could notappliances of NAC 1.0) as a commodity capability
be expected to report their status to a NACavailable within the standard networking switching
Framework, thereby breaking the trust model.platforms.
NAC 2.0: A new model for a more secure futureA centralized policy management platform for directing
The future of NACassessment, remediation, access control, reporting,
The new model for NAC, or “NAC 2.0”, that isaudit, and alerting – covering all required use cases
now emerging takes into account the shortfalls ofcombined with rich native assessment and remediation
earlier approaches and aims to solve real businesscapabilities.
problems. It acknowledges and embraces theNAC 2.0 - protecting beyond security
functional roles and division of responsibilities found inRegulatory compliance, industry best practices, and IT
today’s organizations, supports the business goalsgovernance are the new set of drivers behind the
of different groups and endeavors to meet the rapidlyevolution and adoption of NAC. NAC as a tool for
changing requirements of today’s dynamic threatsecurity, productivity, and compliance leads to better
environment.endpoint and network governance. NAC 2.0 will finally
NAC 2.0 – embracing functional rolesenable organizations to get control of their systems
NAC 2.0 has operational impact on three teams in the– in spite of a rapidly evolving threat environment
IT organization. NAC 1.0’s focus on answering theand the changing nature of the network perimeter.
network team’s needs is matched by a realSummary
commitment to the needs of the desktop team, and aNetwork access control is a valuable new technology
new ability to encompass the requirements of thefor protecting an organization’s assets from risk.
security team.Learning from the flaws of earlier solutions, NAC is
Network teamnow evolving into NAC 2.0, a more mature set of
As discussed earlier, the network team is where manyintegrated technologies that embraces the multiple
NAC solutions were originally embraced and it seemedfunctional roles in the organization, focuses on solving
natural for this team to be the primary owner ofreal business problems, and supports a dynamic
“network” access control, although in realityenvironment. NAC 2.0 is the future of network access
NAC is about more than just the network. This teamcontrol.