Hardware-based network access control, agent-based software network access control, agentless software network access control or dynamic network access control all improve network security. To choose the right solution, IT managers need to consider the goals of their network access control deployment, including the level of security versus manageability desired. Knowledge Center contributor Stacey Lum explains what IT managers need to know to determine the best network access control option for their type of environment.
Few would argue that network access control doesn't improve security. NAC
quickly vets users from those systems who shouldn't be granted access, and it
makes sure that crucial policies such as firewall settings, anti-virus and
patch levels are up-to-date. When done right, NAC creates a network with
traffic flows clean of malware infections and many other risks associated with
The catch? Yes, there's always a catch: Many NAC solutions have proven to be
expensive to deploy and manage. In this article, we'll tell you what you need
to know to determine the best NAC option for your type of environment. But,
before we get into that, we need to quickly recap the four primary types of NAC
1. Hardware-based NAC.
Whether in-line or out-of-band, these options
typically require that an appliance be installed at almost every location where
NAC will be enabled. Some of these appliances displace the access switch, while
others operate between the access layer and network switches.
2. Agent-based software NAC.
Next up is the agent-based approach.
Here, agents are installed on each NAC-enabled device. These agents scan and
monitor the device, typically sending the results back to a centralized server.
Systems found to be out of compliance are not granted access, and are often
sent for some type of remedial action.
3. Agentless software NAC.
Agentless NAC, which consists of a
dissolvable agent, is another common approach. With this setup, the idea is for
a temporary agent-usually some type of ActiveX control-to scan endpoints
periodically for vulnerability and/or policy assessments. The scan results are
sent to a policy server, and remedial action, if necessary, is taken on
noncompliant systems. When the process is complete, the temporary agent
4. Dynamic NAC.
That brings us to dynamic NAC, which uses agents but
only on a percentage of systems. Also known as peer-to-peer NAC, this approach
doesn't require network changes or software to be installed on every system.
The agents, some of which become enforcers, are installed on trusted systems.
Then, similar to a police force, you need only a small ratio of law enforcement
to the general population to make certain everyone is in compliance.
Whether you select hardware, software, agentless or dynamic NAC, you need to
consider the goals of your NAC deployment such as the level of security versus
manageability, as well as other facets that depend on the size of your business