Features

Network access control stands out as one of the most promising security technologies, but it also is one of the most misunderstood. Here are explanations that may clarify some of your questions.

What is NAC?

At a high level, as defined by Forrester Research, "NAC is a mix of hardware and software technology that dynamically controls client system access to networks based on their compliance with policy." But vendors, eager to get in on the NAC buzz, are often using the NAC label for products that are really only peripheral to the access control process. What are the major NAC initiatives?

There are three: Cisco's Network Admission Control architecture; the Trusted Computing Group's (TCG) Trusted Network Connect (TNC) program; and Microsoft's Network Access Protection (NAP) architecture.

Are Cisco and Microsoft playing nicely together?

Microsoft's NAP architecture is a major factor in the NAC universe because of the pervasiveness of the company's server and desktop software. However, at this point, key components aren't available, making interoperability impossible to test beyond limited beta versions of Microsoft's NAP platforms. On the upside, 75 vendors have pledged to make their gear interoperable with Microsoft NAP components when they become available. This includes Cisco, with which Microsoft is developing NAP and Cisco-NAC interoperability. Cisco, which is pushing the IETF for NAC standards but does not participate in TCG, has about 30 partners shipping Cisco NAC-compatible gear and another 27 developing such products.

Are there any NAC standards?

The TCG is writing NAC standards to promote multivendor interoperability. The IETF has created a working group to develop NAC standards and Cisco, which does not participate in the TCG, supports the IETF effort.

Are there any stand-alone NAC products on the market?

Cisco, Microsoft and TCG list scores of partners whose gear fits in their NAC schemes and can claim to be NAC vendors. Plus, Juniper has its unified access-control environment. A NAC buyer must find out what a vendor means by "NAC support," but single devices fitting the NAC bill include products from ConSentry Networks, Nevis Networks, StillSecure and Vernier Networks. Other NAC vendors, such as Lockdown Networks and Mirage Networks, work in conjunction with partners. This is not a comprehensive list.

What types of security functions are part of the NAC environment?

Authentication; endpoint scans; policy compliance checks; policy creation, enforcement and management.