Who needs NAC anyway?

Passing the health test doesn't mean the machine is free of infections that can cause harm to the network, but it helps reduce the chances that the machine will cause trouble.

So far colleges and health facilities have embraced this aspect of NAC more so than other businesses because they both have large populations of users with mobile devices that attach, disconnect and reattach to networks. NAC helps give some assurance that these devices have maintained a sound security posture while disconnected.

The primary thing NAC does is decide which hosts are allowed to attach to networks and stay there. The criteria for making these decisions can vary widely, from a having a media access control address that is on a white list to passing a health check that looks for a range of parameters. These can include such factors as an updated antivirus software that is running a patched operating system, required registry settings and a properly configured personal firewall to name a few.

The criteria can also include whether a device remains in a healthy state and whether it behaves properly once it is admitted to the network.

The hope is this admission control will prevent machines that might have been compromised from contaminating networks with malware and from pilfering data. Mobile devices and devices brought onto networks by visitors and consultants are examples of potentially threatening machines. Northwest Mississippi Community College could get done for the first two weeks of every school year -- until this past fall when the college installed NAC gear that automates the process. Now, with that time freed-up for six full-time IT staffers plus student staff, Mirage Networks NAC equipment has just about paid for itself in one semester, says Chuck Adams, the network administrator at the school's Senatobia, Miss., main campus.

"We wanted to get out of the touching-student-PCs business," Adams says. "We're not 100% there, but we're almost there now."

Before jumping into NAC, potential customers need to define clearly what restrictions are desirable and what constitutes a healthy host, says Mark Rein, director of IT at Mercy Medical Center in Baltimore. "You have to identify what you're trying to protect, identify different [network] segments you might need to set up," Rein says. That translates into policies set up for the NAC gear to enforce. "The policy gets to what you need to know and what you don't need to see," he says.

In practice, businesses are not yet very aggressive deploying NAC, says Andreas Antonopoulos, senior vice president of Nemertes Research .

Being able to connect to a VPN is the only role for NAC with most remote hosts, he says, and virtually no businesses use access control on LAN ports, according to his poll of IT executives earlier this year. He says only about 14% of respondents apply endpoint checks for application and operating system patches; the presence of firewalls, antivirus or antispyware; USB-attached devices; and password strength.