The tested product during the PoC were Consentry, Infoexpress, Aruba ECS, Bradford and Juniper
Bridging provide an ad-hoc connection for the attacker be inside of any secure cooperate network. Since the network bridging technique capable to bypass the gateway security, it become the most critical feature need to be include in tested NAC. The NAC solutions must be able to detect the network bridging activities running by the users as follows:
- bridging via UTP cable
- bridging via Bluetooth
- bridging via GPRS, Edge, 3G, HSDPA and
- other possible method of bridging such as via firewire, USB, PCMCIA etc.
The team also include other requirement as follows
- the system must be able to quarantine or disconnect or isolate the users from the wireless network once they activate the bridging processes. .
In fact, most of the bridging activities is able to create a back door to any secure network. That’s why this feature is really really important to them
In addition, the overall design of network infrastructure in IIUM network considered as a heterogeneous network. They have add another important requirement for the test NAC appliance must be able to support multiple protocol such as 802.1x and non 802.1x including multiple OS platform: e.g Windows, Mac OS X and Linux Clients.
Finally after the PoC, Mr. Jaiz and his team conclude that, non of those 5 NAC 100% meet their requirement but they have rank all those product after taking into consideration a few aspect according to their network environment and end user experiences.
- Infoexpress
- Juniper
- Aruba ECS
- Bradford
- Consentry
What’s So Great About Deploying NAC in IIUM ?
The planning deployment of Network Access Control (NAC) technology aims to protect IIUM heterogeneous wireless networks from the public back door (possibly done through 3G, bluetooth, firewire, UTP, USB etc), and often dangerous, Internet. It also provides protection from viruses and other types of malware that may be resident on the mobile gadgets that staff, students and visitors connected into IIUM wireless networks. NAC places a virtual shield around a network by guarding its endpoints, the places where heterogeneous wireless networks mesh with the outside world.
A survey conducted earlier this year by Infonetics, a technology research firm located in San Jose, Calif., found that enterprises acquire NAC technology for various reasons, including blocking viruses (86 percent), intercepting external attacks (80 percent), stopping spyware/malware (73 percent) and blocking e-mail attacks (70 percent). Other motivations cited by the respondents included regulatory compliance (54 percent), adding LAN security (45 percent), blocking internal attacks (38 percent) and meeting customer and business partner demands (36 percent).
Much of NAC’s overall appeal comes from its simplicity, as well as its ability to provide enhanced security and more sanitized networks with little or no negative impact on the community productivity especially in IIUM. In fact, many instituition that have adopted NAC technology report improved productivity. By deploying this, IIUM Community are now free to use devices that were formerly banned from any other enterprises networks due to security concerns. By deploying NAC, ITD is trying to secure the wireless connection even browsing via smartphone or PDA since this devices is not really have a good antivirus software. The Symbian OS has been infected by mobile virus.
NAC often arrives on customer premises in the form of a network appliance. This approach is appealing to many enterprises, and the solution that ITD is looking for: the appliance must simply be plugged into the wireless network, providing fast, painless, out-of-the-box security and avoid changes to the existing configuration. Many NAC appliances are multifunction security devices, offering capabilities such as network-based virus scanning and intrusion prevention systems (IPSs) along with NAC capabilities. The appliance must be capable to integrate with the existing equipments.
Non-appliance-based approaches to NAC are more complex and tend to require a bit more hands-on work. The available alternate choices are to enforce NAC with functionality that’s built into network devices, such as switches, or to enforce NAC using SSL VPN gateways.
No network is airtight—malware continues to get in, whether via mobile gadget (PDA, smartphone), staff, student or guest laptops, or end users downloading dodgy content. Antivirus software at the gateway or on the desktop helps with computers under your control, but guests and unmanaged servers remain problematic. And let’s face it: Sometimes attackers are just smarter than we are. Even companies following best practices get hit.
Deploying NAC don’t just mean just security best practices, either. Protecting the network from malicious hosts is, ultimately, a desktop management function. NAC is what puts teeth in our policies, providing an enforcement mechanism that helps ensure computers are properly configured. By weighing such factors as whether a user is logged in; their computer’s patch level; and if anti-malware or desktop firewall software is installed, running and current, ITD can decide whether to limit access to network resources based on condition. A host that doesn’t comply with your defined policy could be directed to remediation servers, or put to the quarantine VLAN.
Remember Slammer? If a company could have determined that a host was running an unpatched version of MSDE 2000 and denied access until it was patched, Slammer would have had a much less dramatic effect.
With all the available choices, settling on the right NAC technology from the right vendor requires a significant amount of research. The final selection usually boils down to finding the product that most closely matches the IIUM’s NAC goals and the network’s size, complexity, budget and configuration
