NAC - Network Access Control
Network Access Control (NAC) is an approach to computer security that attempts to unify endpoint security technology (such as antivirus, host intrusion prevention, and vulnerability assessment), user or system authentication and network security enforcement. NAC solutions have become an extremely valuable tool in recent years, as mobile devices and the Internet of Things (IoT) have surged to prominence in various industries across the world. These new pieces of emerging technology come with their own set of vulnerabilities, which poses a challenge to IT security experts.
NAC systems are put into place to make sure that anyone who enters the system, both in terms of users and devices, is authorized. After being routed the efforts at connection, the network access control system confirms privileges using an identity and access management (IAM, a program that checks users for appropriate permissions to access data materials, as indicated by internal policies). With the information from the IAM, along with a pre-established list of rules, the NAC software is able to smartly accept or deny access requests.
Fortunately, NAC products are designed to handle large enterprise networks that have a range of device types trying to connect at all times. Without a NAC in place, companies take on a huge amount of risk by adopting a bring-your-own-device (BYOD) policy, which allows employees and vendors to use their own smartphones and tablets on the local network. Network access control software and hardware require an upfront investment but prove their worth in the long run.
Compare of products in the category NAC - Network Access Control
Ease of Implementation |
Software-Based |
Heterogeneous Network |
Centrally Managed |
VLAN Segmentation |
Standardized API |
Role-Based Policies |
Agentless |
Full Non-802.1X Deployment |
No Requirement for Topology Changes |
Scalable Deployments |
Remote Branch Deployments |
Wireless Support |
Device Visibility |
Application Visibility |
IOT Device Visibility & Control |
Network View |
Incident Response |
Guest Access |
BYOD |
Requires network pre-requisites
|
Requires network pre-requisites
|
Complex, requires advanced integrations and deployment skills
|
Deployment driven, modular software, intuitive, flexible
|
||||||||||||||||
Virtual or hardware appliance
|
Virtual or hardware appliance
|
Virtual or hardware appliance
|
Software-only
|
||||||||||||||||
Can integrate with some infrastructure
|
Works best with Cisco environment
|
Integrates with all network infrastructure
|
Integrates with all network infrastructure
|
||||||||||||||||
Recommends appliances for deployment in all locations
|
Recommends appliances for remote locations
|
Recommends appliances for remote locations
|
Deployed from one location, no need for remote appliances
|
||||||||||||||||
Available only with 802.1X
|
Available only with 802.1X
|
Limited support for VLAN
|
Native implementation of VLAN segmentation
|
||||||||||||||||
Inbound and outbound APIs
|
Offers scalable context
|
Integrates with other services
|
Shares context both inbound and outbound
|
||||||||||||||||
More effective with 802.1X
|
More effective with 802.1X
|
Define policies based on organizational roles
|
Define policies based on organizational roles
|
||||||||||||||||
Optimal with agent
|
Requires an agent for posture assessment
|
Requires a dissolvable agent for full functionality
|
Support for over 25 different authentication methods that do not require an agent
|
||||||||||||||||
Optional 802.1X authentication
|
Requires 802.1X to authenticate devices
|
Does not require 802.1X to authenticate devices
|
Does not require 802.1X to authenticate devices
|
||||||||||||||||
Network firmware upgrades, complex configuration, RADIUS
|
Network firmware upgrades, complex configuration, RADIUS
|
Many features rely on the configuration/set up of port mirror/span port
|
No requirements for mirror or span ports
|
||||||||||||||||
802.1X limits scalability of deployments
|
802.1X limits scalability of deployments
|
Requires additional appliances and upgrades
|
Lightweight infrastructure enables easily scalable deployments across geolocations
|
||||||||||||||||
Requires on site configuration and challenges branch availability
|
Requires on site configuration and challenges branch availability
|
Recommends on-site appliances for full feature set, limitations for sizing
|
Seamless coverage of remote branches
|
||||||||||||||||
Wireless via 802.1X
|
Wireless via 802.1X
|
Partial integration with on-premise wireless controllers
|
Optional 802.1X wireless
|
||||||||||||||||
Visibility enhanced with 802.1X compatible devices
|
Visibility enhanced with 802.1X compatible devices
|
Visibility into all network devices only with port mirroring enabled
|
100% streamlined device visibility (NAS and device view)
|
||||||||||||||||
Requires agent
|
Requires agent
|
Enhanced visibility into business level applications
|
Seamless application data collection
|
||||||||||||||||
Discovery and control capabilities
|
Basic profiling of IoT devices
|
Discovery and control capabilities
|
Two-fold device detection and analysis
|
||||||||||||||||
No capability for full network view
|
No capability for full network view
|
Limited capability for full network infrastructure view
|
Simple to operate, understand issues and see them immediately
|
||||||||||||||||
Lack of context, requires manual intervention
|
Lack of context, requires manual intervention
|
Built-in integration with various security vendors
|
Open-platform, native API integration, intuitive data flows
|
||||||||||||||||
Full capabilities for guest access
|
Full capabilities for guest access
|
Full capabilities for guest access
|
Limited native capabilities
|
||||||||||||||||
BYOD control and visibility with captive portal
|
BYOD control and visibility with captive portal
|
BYOD control and visibility with captive portal
|
Limited native capabilities for BYOD control
|
Suppliers NAC - Network Access Control
Vendors NAC - Network Access Control
F.A.Q. about NAC - Network Access Control
How a NAC solution works?
When you adopt a network access control solution, the first thing it will do is find all devices currently accessing the system; identify what kind of device they are; and determine whether to validate them and how to treat them using preestablished protocols designed by the company’s security personnel. A network access control system has rules related to a wide spectrum of devices, along with finely grained settings to help you determine permissions. A unified administrative system houses these rules and applies them as needed.
Many companies will utilize NAC as their staff grows and they have an increasing number of devices to manage. These solutions are also helpful for achieving data protection across a variety of different branch locations. The difficulty of securing an organization and managing access has become especially overwhelming in an era when widespread incorporation of IOT devices is becoming more common throughout business; NAC is the fix. The general issue with bring your own device (BYOD), though, is what drew many businesses to this service.
How to Choose a Network Access Control Solution
To help narrow down your search for NAC products, you should first focus on tools that offer native integration with your enterprise’s existing software. You don’t want to have to change your infrastructure or network design in order to bring the NAC solution online. If you are heavily dependent on a cloud architecture, then look for solutions that are fully supported by your hosting provider.
Next, think about what kind of proactive tools come included with the NAC suite. Some vendors offer all-in-one packages that feature a full virus scanning utility and firewall mechanism alongside everything else in the NAC. If your IT security strategy is not very mature, this kind of suite may be very helpful.
Of course, one key factor when looking at NAC options is the price point. Some vendors will sell their products at a flat rate, while others are quickly going the route of Software as a Service (SaaS) subscription, an increasingly-popular business model that requires a monthly payment and ongoing contract. Think about the state of your IT budget while remembering that the upfront investment could save you lots of money down the road.
Network Access Control Systems
https://www.anti-malware.ru/security/network-access-control