- 595 immigrants arrested at electronics plant
- Techiest celebrity endorsements
- Network failure delays flights across U.S.
- Alcatel-Lucent intros Gigabit Ethernet switches
- Firefox browser gets security boost
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
It's useful to regard NAC as a personal firewall that uses more comprehensive parameters in making access decisions than a traditional firewall does.
Where a stateful, Layer 3 firewall makes such determinations based on source and destination IP addresses and what port is being used, NAC can go much further.
It ties the access decision to a person rather than to just a machine where it connects to the network. These additional factors include how the user is connecting, whether via VPN, wireless access point or over the LAN. It can include where they are connecting from - home vs. a branch office vs. a gate at an airport.
It can include whether the machine is managed or not and whether the device meets health-check requirements set by the business. These can include patches on operating systems (Compare Patch and Vulnerability Management products), antivirus software updated and turned on (Compare antivirus products), encryption turned on and the like.
NAC can also weigh destination IP addresses and ports, just as a firewall does.
Beyond that it can continuously monitor what the admitted machine/user pair is doing while it’s on the network and apply policies to what is and is not allowed
This lengthy list of what NAC can do makes it a very granular control method that could result in policies that are crafted per user.
The more detailed the controls, the more sophisticated the management of these policies need to be. The ability to effectively manage these policies can make or break a NAC deployment, particularly a large complex one.
Be sure to give the management platform a workout when weighing which NAC product to buy (Compare NAC products).
| NetworkWorld, Inc. | About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW |
| IDG, Inc. | CIO | Computerworld | CSO | Demo | GamePro | Games.net | IDGconnect.com | IDG World Expo | Infoworld | JavaWorld.com | LinuxWorld.com | MacUser | Macworld | PC World | Playlistmag.com | The Industry Standard | IDG List Services | IDG TechNetwork |
 |
Copyright © 1994-2008 Network World, Inc. All rights reserved. |
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.
Download the white paper.
Unauthorized applications: Taking back control
Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?
Download the white paper.
Comments (3)
it's useless to regard NAC as a personal firewall...By Anonymous on July 3, 2008, 2:57 pmit's useless to regard NAC as a personal firewall...
Reply | Read entire comment
the many faces of nacBy Anonymous on July 2, 2008, 10:57 amTim- while you know I agree with you that NAC is very versatile, I don't think comparing it to a personal firewall is the right analogy. I have written more about...
Reply | Read entire comment
Poor comparisonBy Anonymous on July 1, 2008, 9:09 amThis is a pretty poor comparison. NAC is more like a dynamic network firewall, personal firewall means to me the client makes the decision, whereas with NAC it should...
Reply | Read entire comment
View all comments