In this age of worms, zombies, and botnets, mobile computers themselves are a kind of Trojan horse. Do you know where that computer’s been? No, you really don’t.

In its most basic form, NAC (network access control) enforces organizational policies on systems when they attempt to connect to the network or when they attempt to enter a particular part of the network (for example, when they connect from an edge switch into the core). A NAC system makes determinations about the device and access control decisions based on those determinations. The status of the device can be as simple as an authentication by a known user or as complex as an external or internal scan of the client system. The external scan may look for known vulnerabilities, open ports, and the like, while the internal scan may check operating system parameters and patch levels, installed or running processes, currency of applications such as anti-virus signatures, and so on. Based on this “posture” (in IETF parlance), the NAC system decides what access (if any) the device gets. The combination of authentication and posture produces substantial information for NAC policy granularity. (See also "NAC policy management wags the watchdog" and "Accelerate your 802.1x rollout.")

Something else to consider are changes that occur to devices after they are granted access. Whether the user is intentionally malicious or unknowingly so, the device may become a threat to the network after it has gained access, as new processes become active, new exploits propagate, or other events occur that turn the device into an attacker. More-sophisticated NAC systems can detect these kinds of events and trigger policies at times other than when the device initially connects to the network.

In this roundup, we examine four solutions that address the business problem of rogue systems: Enterasys Sentinel Trusted Access, McAfee Policy Enforcer, Symantec Network Access Control, and Trend Micro Network VirusWall Enforcer. We created six different scenarios that are typical for businesses and configured each of the NAC solutions to address them as closely as possible. The scenarios included access by an unauthenticated guest, an authenticated guest (using either 802.1x or Web-based authentication), an authenticated user (with good device posture, and with bad device posture), and a privileged user with special access rights. We also tested how the solutions handled a good device turning bad after access. For more details, see “How We Tested.”

The Enterasys, McAfee, Symantec, and Trend Micro solutions together offer a glimpse into the variety of options available to organizations that desire to protect their infrastructures from the ravages of compromised Windows systems.

The Enterasys system provides policy-based network enforcement on switches and uses system scanning, system state, and (optionally) network intrusion detection to determine the posture of the devices attempting to attack. The Trend Micro system is an enforcement gateway, examining traffic passing through the device and using posture collectors on the clients to determine status for consideration in enforcing the policies. Symantec offers both a NAC gateway and DHCP-based enforcement. You might use only one or both of the Symantec products in your NAC architecture, depending on requirements. Like the Trend Micro solution, Symantec’s system uses posture collector agents and examines traffic passing through the gateway to determine what is allowable and what is not.