NAC NAC: Who’s Really There? (And What Are They Bringing Inside)

NAC, NAC: Who's Really There
(and What Are They Bringing Inside?)
A Look at NAC, IT Risk and Alternative Solutions
September 2006







3600 Mansell Road
Suite 200
Alpharetta, GA 30022
888.566.9143
www.trustednetworktech.com NAC, NAC: Who's Really There (and What Are They Bringing Inside?)
Contents
Introduction .....................................................................................................................................................1
What's the True Risk with Compromised Endpoints and Users? ...................................................................2
What Needs to Be Done .................................................................................................................................2
How NAC Works .............................................................................................................................................4
Example NAC Implementations ......................................................................................................................4
NAC Challenges..............................................................................................................................................5
An Alternate Path: TNT Identity ......................................................................................................................6
Example TNT Implementations.......................................................................................................................8
The Approach: Bypass NAC or Extend It?......................................................................................................9
Conclusion ................................................................................................................................................... 10
© 2006 Trusted Network Technologies, Inc. page ii
NAC, NAC: Who's Really There (and What Are They Bringing Inside?)
Introduction Industry chatter about NAC technologies has reached a roar. Network security research firm Infonetics has projected that revenues for NAC solutions will soar a staggering 1,100% by 2008.
So what's all the noise about? NAC stands for network admission control or network access control, depending on whom you ask. Either way, most NAC technologies have the same objective: Make certain that only healthy computers connect to the network. NAC seeks to make sure a computer has stuff it needs (updated patches, antivirus software, firewall) and doesn't carry bad stuff (viruses, worms, spyware) before letting it on the network. Most NAC solutions also quarantine unfit computers, limiting them to a certain network segment until they get healthy. Organizations view NAC as a way to prevent the billions of dollars in damages from viruses like Blaster and SQL Slammer.
The stakes have never been higher. The CIO of several Southeastern hospitals told TNT recently about a worm from a compromised laptop that shut down IT operations for an entire hospital. The incident had an obvious business impact, but it also threatened patient care. Lives were at risk, not just data. This troubling example adds to a growing list of similar events affecting organizations of all types and putting people, performance and profitability in jeopardy.
But does NAC cure all network and information security ills? Well, no. NAC authenticates a computer to the network if it has the proper health posture (pre-admission). Most NAC technologies don't know or control where users and computers go or what they do once they on the network (post-admission). Also, NAC solutions often require costly new or upgraded network hardware and software.
So how should business and network managers and executives evaluate evolving NAC technologies? The focus should be on mitigating risk, controlling access and protecting data-and determining which technologies do these things simply and inexpensively. All the technical discussions about standards, networks, firewalls, switches and servers don't alter these core objectives.
With that context, this paper addresses several issues organizations should consider when analyzing the efficacy and costs of NAC solutions:
. The damage compromi... [download for more]