Definitions: Network Access Control

Definition

Network access control is a security technology designed to  authenticate and prescreen clients before they access network resources to  ensure that they comply with endpoint security policies. Based on the status of  the endpoint, network access control (NAC) technologies may allow clients  access to limited network resources, update them with proper security software (for example, antivirus or service packs), or deny them network access.

Business applications

The traditional network perimeter has dissolved as  organizations have opened their networks to business partners, offsite  employees, contractors and guests. These parties can pose a risk if their  endpoint devices do not have up-to-date antivirus software, patches, or  personal firewall settings, or they access sensitive resources. Network access  control allows organizations to extend network access to visitors while  ensuring that the endpoint devices aren’t introducing vulnerabilities into the  network and while limiting access to specific resources.

Deployment Concerns

Network access control sounds like a panacea, but the technology is far from mature and not every company needs it. Experts recommend considering NAC if your organization is  concerned about authenticating users or the security of the systems accessing  the network, or if you need more granular access controls. If you do choose to  implement the technology, then a phased deployment is recommended, beginning  with IT.

Many experts are skeptical of NAC’s benefits,  as the technology has yet to prove itself. Several vendors have developed proprietary technology, but none has taken off or set a standard as  the way network access control should be done. Its practicality has also been  questioned in environments where a large number of diverse endpoints require  network access.

Technical details

Network access control systems can be installed inline or  out-of-band. Inline NAC systems are often single-box appliances installed  between users and the rest of the network and often require recabling.  Out-of-band NAC systems reuse existing infrastructure, but also require changes  to switches and routers. While inline systems can pose as a single point of  failure, out-of-band systems offer the ability to manage one or multiple networks.