NAC appliances reveal who's rapping at your network door

As the NAC (network access control) market matures, the solutions are becoming more sophisticated at identifying users and assessing the security compliance of host devices. Answering questions such as how snugly they fit into the existing infrastructure (is it a forklift upgrade?) and how well they qualify a device’s security compliance posture before admitting it to the network helps to separate the wheat from the chaff.

NAC is all about identifying end-users, checking their host devices to ensure they’re within defined security requirements (anti-virus installed and running, for instance), and then assigning a security policy to them.

The security policy is key. It has to be created dynamically to fit a user’s current security status. The policy must determine whether the user is logged in on a wireless connection or in a conference room. Is it a line-of-business manager or the CEO? Are the user’s anti-virus signatures current? Are there any open ports on the hosts that violate acceptable policy? As a user’s posture changes, so should the security policy they receive.

When selecting a NAC system, administrators will also need to consider whether they want to deploy a solution that enforces at the host level or at the network layer. Doing it at the host level entails installing software agents on end-user systems across the enterprise and requires local access to each host. This approach can provide an extremely effective means of enforcement (see Elemental Compliance System).

Controlling user access at the network level may require wholesale equipment upgrades, but it can prevent an unknown user from gaining even the tiniest access to the LAN.

In this review, I tested four NAC appliances that enforce at the network layer and inspect all end-user traffic as it passes through. I had the opportunity to check out the Caymas 525 Identity-Driven Access Gateway, Lockdown Networks Enforcer 4.2, Nevis Networks LANenforcer 1048, and the Vernier EdgeWall 7000.

The good news is that each solution actually works insofar as authenticating users and applying access policies to them. All support a captive portal log-in for user authentication, which is fine for guest or unmanaged devices, but a captive portal is Caymas’ only means of logging in users. All vendors but Caymas support 802.1x for a more seamless log-in for managed devices. Two of the appliances reflect some of their past uses: Caymas has a strong SSL VPN history and Vernier includes many features borne of wireless security. Neither of these features detracts in any way from their respective products; they just add flavoring.

End point vulnerability assessment is where the products vary the most. Of the four, only Nevis currently lacks a host-checking engine. Caymas pushes either an ActiveX or Java agent down to the client on connect (which requires the logged-on user to have local administrative or power user rights), and destroys the agent at log-off. Vernier’s host check is agentless but does need Windows credentials to scan the device. Lockdown covers all bases with an agentless mode, Windows and Mac agents, and SMB (Service Message Block) scanning like that in Vernier. The one common theme is that for any of these solutions to truly determine the security posture of a host, access to the local device is required.