Feeds

NAC's looming identity crisis

Will persistence pay off for NAC vendors?

Top 5 reasons to deploy VMware with Tegile

Current network access control (NAC) technologies are not persistent enough, a security vendor has warned.

Dominic Wilde, product management veep at Nevis Networks, said that most NAC schemes rely on out-of-band appliances which check whether a client device is "clean", and once it passes muster they grant it access.

This makes them easier to install and remove, but he said it also means that once a client has been approved, there's no further control over where the user can go on the network or what they can do there.

"The first thing you need in the security world is to be stateful, so you understand the request going out and marry it to the response coming back," he said.

The second, he added, is to persistently track the user's identity: "Networks are by nature anonymous - you have MAC and IP addresses, but that's meaningless when customers are trying to solve compliance issues of who has access to what and when."

Needless to say, Nevis's security gear doesn't suffer this flaw, Wilde claimed. It sells an in-line security appliance and a secure access switch, both of which have built-in logic capable of controlling what the user can do and where they can go on the network. It also doesn't need agent software on the client to ensure it stays clean, he said.

Speaking as Nevis opened its UK office this week and began recruiting resellers for its devices, Wilde added that part of the problem is that most NAC technology operates at Layer 2 - the switching layer - using techniques such as virtual LANs to quarantine infected PCs.

"People are taking technologies designed for networking and applying them to security, and that's not what they're designed for," he said. Instead, they should work at Layers 3 and 4 - the routing and TCP layers - drawing user information from the corporate directory and using it to create an access policy for each user, he added.®

Beginner's guide to SSL certificates

More from The Register

next story
Ellison: Sparc M7 is Oracle's most important silicon EVER
'Acceleration engines' key to performance, security, Larry says
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Lenovo to finish $2.1bn IBM x86 server gobble in October
A lighter snack than expected – but what's a few $100m between friends, eh?
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
Hey, what's a STORAGE company doing working on Internet-of-Cars?
Boo - it's not a terabyte car, it's just predictive maintenance and that
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.