Revitalized NAC for LAN and Cloud

As long as enterprise organizations try to maintain private networks, the challenge of determining which devices are considered safe for entry will remain. Whether this access decision is made using physical or virtual enforcement controls does not matter much from a policy perspective. Organizations desiring private LANs will simply want something workable to determine which devices are allowed admission, and which are not.

Traditional enterprise local area security teams have relied on a technology known as network access control or NAC to provide such policy enforcement. NAC is sort of like transportation security at your local airport: You arrive at a checkpoint, you present requested credentials, you go through some careful screening, and then an access decision is made. None of this is convenient, and none of it happens instantaneously. But we all agree that it is necessary.

What are the prospects for NAC in a world where the traditional LAN is being rapidly evolved by mobile and cloud? And what of the disappointment many security experts have previously expressed with NAC?

Enterprise NAC faces challenges, and many 802.1X-based implementations burdened by unbridled complexity. But the prospects for NAC in the modern enterprise are dramatically improving, coupled with powerful means for extending such protections to the cloud. “Next generation network access controls for cloud,” according to Portnox CEO Ofer Amitai, “will be a critically important component of the virtual enterprise.”

The original approaches to NAC had several challenges from the outset. First, they tended to be vendor specific, with required endpoint agents, and mitigations based on network traffic manipulation. These methods carried considerable downside; for example, few non-trivial networks are built on the capability and offerings of a single network vendor. Even in the presence of standards, interoperability issues were often the root cause of problems.

Portnox has focused its NAC product efforts on addressing these challenges directly for both the enterprise LAN and the extended hybrid cloud (to include IoT systems as well). Seamless, agnostic coverage of multiple vendor deployments, for example, is one of the focus areas of Portnox – and this should be welcome news to any network security manager supporting complex functional requirements for the hybrid enterprise.

Perhaps the most evolved NAC consideration in the Portnox suite is its emphasis on visibility across access layers. Surprisingly, early attempts at visibility from NAC were downplayed, simply because the (stubborn) presumption was that access policy would be enforced at LAN admission time. This carries the logical assumption that only good devices would ever be permitted entry to the LAN – which we all know is not how things evolved.

All of this is good news for any CISO team operating on an existing perimeter-based LAN (which means essentially every CISO team), with clear transition on-going toward hybrid cloud. The requirements to protect admission and entry to the corporate network remains a control demand in every framework I’ve ever seen. It, therefore, stands to reason that teams should partner with NAC vendors who understand the present – as well as the future.