Intro

In this lesson, we take a brief look at network access control or knack you can download the script for this video from above or at the end of the video.

What is Network Access Control

Network access control is a combination of protocols and safeguards that ensure that only policy-compliant devices connect to an organization's network and to what those devices can connect. Some NAC solutions also frequently check to ensure a connected device continues to comply. Many NAC solutions exist, and some organizations might use a collection of solutions to enforce device policy. Because there are various ways to approach NAC, I address policy enforcement at a high level, providing guidance for achieving knack objectives.

NAC Objectives

NAC usually attempts to address a basic set of objectives. Zero-day attacks are a continuous challenge for organizations NAC can help by enforcing zero-trust access. Access control goes beyond authentication of the user. User identity management is paired with device scanning. Device scanning ensures that all devices connecting to sensitive resources meet a required policy baseline. Zero-trust networking, as described in detail at the link above, is supported with multi-factor authentication and device evaluation to strongly control what each connected device can see or access.

How NAC works

Let's take a high-level look at how NAC works. When a device attempts to connect, it is assessed by a NAC service to ensure it meets policies in the network access control database.

Pre-admission Analysis

This assessment is done in one of two ways: pre-admission and post-admission In pre-admission, an endpoint is assessed to ensure it meets policy compliance before it is allowed to connect. If the endpoint fails to comply with one or more policies, it is either denied access or is sent to a quarantine network segment. This is known as pre-admission assessment.

NAC Quarantine

The quarantine segment might contain servers that allow a user to install an approved anti-malware application firewall or current patches.

Capture Portal

This is an example of what is called a capture portal. A capture portal sends a user to a quarantined service that allows the user to bring her device into policy compliance. Once an endpoint completes remediation steps, it must once again attempt to pass NAC assignment.

Endpoint Scanning Objectives

Endpoint scanning is done in two ways. In the first approach, a NAC software agent is installed on each endpoint. This agent continuously collects information that relates to policy enforcement, including patch levels installed, applications approved, firewall presence and operation, and approved anti-malware presence and operation. Agents make it easy to check device status periodically, especially when attempting to gain access to classified data and highly categorized resources.

Post-admission Analysis

This policy compliance review for already connected endpoints is known as post-admission analysis. We've already looked at pre-admission analysis in the previous slide. A second way to scan endpoints is via a browser application browser applications do not require installation and management of agents.

Inline vs. Out-of-band

NAC appliances can be placed inline or out of band. Out-of-band devices separate analysis and enforcement across multiple appliances managed by a centralized console. This approach allows an organization to use already installed network devices like switches and firewalls to enforce policies. Inline devices force all traffic to flow through them instead of simply augmenting existing infrastructure. They usually sit above the access switch level. According to the CISSP CBK, some contend that out-of-band approaches can be disruptive. On the other hand, inline devices must be matched to anticipated business bandwidth, or they can slow business operation. That's it for this lesson. If you have questions, please ask. ...and until next time be careful what you click.