Cosc 5/4765 NAC Network Access Control

What is NAC? The core concept: –Who you are should govern what you’re allowed to do on the network. Authentication Endpoint-security Assessment Network environment information

What is NAC? (2) Except it’s not that simple –Even the vendors confuse the definition –The architectural options are complicated Multivendor options are even more complex. –There are lots of Questions that arise about varying implementations/vendors.

What is NAC? (3) Wired, wireless, and/or VPN? Is NAC a monitoring system or just for entry onto the network. IE once the security and authentication is done, now what? Is it an application on the computer or not? Inline or outbound monitoring –assuming monitoring

Approaches to NAC Edge control –The principle of a firewall pushed to where the clients connect Core control –NAC device on the network collects authentication and endpoint security info. It enforces policy control Client control –An application on the client that enforces client control. Example: Turning off wireless when the VPN is not connected.

Core Theory Apply a policy for network access across LAN, wireless and VPN infrastructures. The access-control policy –a go/no-go decision on network access –a choice of virtual LANs –As complex as a set of per-user firewall rules defining which parts of the network are accessible.

General deployment A client NAC on the system –Collects client data about the “health” of the system. A policy management appliance –Can be used for authentication –Can be problematic. –Uses data from the client NAC to determine network access. –May also do client monitoring to determine the client is behaving correctly.

Generally how NAC works.

Client NAC Collection of typical data –AntiVirus installed and up to date –Client patched to a standard. –Registry checks –P2P and file sharing –Applications install/not installed. Malware/spyware and commercial software

Without a Client NAC Some implementations allow for clientless NAC –System attempts to determine status of the system Asks the computer for information Some doc’s show it can be falsely detected as an attack.

Monitoring Inline –Allows for post enforcement (monitoring) of systems. –Allows layer 2 through layer 7 (some only layer 4) inspection. Out of band –Little disruption to the network –Can filter based on user and/or categories instead of everything.

A Setup for Cisco NAC

full-featured access control solution can do: Control who can get onto your LAN and limit what resources they can reach Limit the reach of less-trusted or less-known users –such as contractors, technicians, remote users, or offshore workers Restrict who can access sensitive financial or customer records Control access to data based on role, time of day, location, and application Segment users to meet compliance requirements Protect against known and unknown malware Simplify incident response Protect critical application services such as VoIP

full-featured access control solution can not do: Protect information that leaves the premises –via , laptop theft, printouts, or USB storage devices Defend against social engineering Block known malware from entering over the WAN connection Prevent users with authorized access from using data inappropriately

Other issues printers, cameras, PDAs, game consoles, phones and other IP devices for NAC compliance. –These devices (mostly) can not use client NAC software And maybe difficult to categorize correctly or at all. –Some NAC can identify certain devices Most of the IP phones for VOIP, since it will use VOIP protocols.

Lastly. This lecture is far from complete. NAC is still a technology BUZZ word and the standards are in flux. Vendors can’t agree on standards –And don’t work with each other. Some flavors of *nix are currently left out of NAC

Q A &

References Mostly web pages: ml and associated articles linked from this page. ml pdf