How to Choose the Best Network Access Control Solution

Few would argue that network access control doesn't improve security. NAC quickly vets users from those systems who shouldn't be granted access, and it makes sure that crucial policies such as firewall settings, anti-virus and patch levels are up-to-date. When done right, NAC creates a network with traffic flows clean of malware infections and many other risks associated with security breaches.

The catch? Yes, there's always a catch: Many NAC solutions have proven to be expensive to deploy and manage. In this article, we'll tell you what you need to know to determine the best NAC option for your type of environment. But, before we get into that, we need to quickly recap the four primary types of NAC solutions:

1. Hardware-based NAC. Whether in-line or out-of-band, these options typically require that an appliance be installed at almost every location where NAC will be enabled. Some of these appliances displace the access switch, while others operate between the access layer and network switches.

2. Agent-based software NAC. Next up is the agent-based approach. Here, agents are installed on each NAC-enabled device. These agents scan and monitor the device, typically sending the results back to a centralized server. Systems found to be out of compliance are not granted access, and are often sent for some type of remedial action.

3. Agentless software NAC. Agentless NAC, which consists of a dissolvable agent, is another common approach. With this setup, the idea is for a temporary agent—usually some type of ActiveX control—to scan endpoints periodically for vulnerability and/or policy assessments. The scan results are sent to a policy server, and remedial action, if necessary, is taken on noncompliant systems. When the process is complete, the temporary agent dissolves.

4. Dynamic NAC. That brings us to dynamic NAC, which uses agents but only on a percentage of systems. Also known as peer-to-peer NAC, this approach doesn't require network changes or software to be installed on every system. The agents, some of which become enforcers, are installed on trusted systems. Then, similar to a police force, you need only a small ratio of law enforcement to the general population to make certain everyone is in compliance.

Whether you select hardware, software, agentless or dynamic NAC, you need to consider the goals of your NAC deployment such as the level of security versus manageability, as well as other facets that depend on the size of your business and network.