-: Network Access Control. 2 2
In this lesson, we're going to talk all about 3 3
network access control. 4 4
Now, network access control or NAC is used to protect your 5 5
network from both known and unknown devices. 6 6
This is achieved because NAC ensures the device is scanned 7 7
to determine its current state of security prior to being 8 8
allowed access to your network. 9 9
Network access control can be used for computers 10 10
that are within your internal network 11 11
that are physically located inside 12 12
your buildings and are connected to it. 13 13
Or it can also be applied to devices that are connected 14 14
to your network remotely through a VPN. 15 15
Now, when a device attempts to connect to the network, 16 16
it's placed into a virtual holding area 17 17
while it's being scanned. 18 18
This scan can be extremely simple, 19 19
like verifying that it's based on the authentication 20 20
using EAP and just making sure that it has 21 21
the right username and password or it can be more intense. 22 22
For example, the device can be checked for 23 23
a number of different factors, 24 24
including its antivirus definitions, 25 25
to make sure that they're up to date the status 26 26
of the security patching and making sure 27 27
that's up to date and other items that might 28 28
introduce security threats into your network 29 29
if you allow that device to connect to you. 30 30
Now, if a device passes this inspection, 31 31
it's then going to be allowed to enter and receive access 32 32
to all of the organizational resources 33 33
that are provided by your network. 34 34
If the device fails the inspection, though, 35 35
it's going to be placed into a digital quarantine area 36 36
and there it's going to await remediation . 37 37
While it's in this area, 38 38
the device can receive its antivirus updates. 39 39
It can get operating system patches. 40 40
And any other security configurations and services 41 41
that it might need. 42 42
But it cannot largely communicate with the other portions 43 43
of the network because it's trapped inside 44 44
this screen subnet that's reserved for quarantine devices. 45 45
Like a bad child, this device has been placed into a timeout 46 46
and there it has to sit until it's rehabilitated. 47 47
Once it's been rehabilitated and can meet the requirements 48 48
of the initial NAC inspection, 49 49
it can then be moved into the regular network and receive 50 50
full access again, to all the organization's resources. 51 51
NAC solutions can either run as a persistent 52 52
or non-persistent agent. 53 53
Now, persistent agents are a piece of software 54 54
that's installed on a device 55 55
that's requesting access to the network. 56 56
This works well in a corporate environment 57 57
because the organization might own 58 58
all the different devices and controls, 59 59
and it can then understand what the software baselines are. 60 60
But this doesn't work well if you're in an environment 61 61
where people are going to use, "Bring your own devices." 62 62
Now, instead in those cases, 63 63
you're going to want to use a non-persistent agent. 64 64
A non-persistent agent solution is very popular, 65 65
especially in college campuses where people bring their own 66 66
devices and connect them to the network. 67 67
These non-persistent agents are going to require the users 68 68
to connect to the network, usually over wifi. 69 69
And then they're going to go to a web based captive portal 70 70
where they're going to log in. 71 71
Once they do that, they're going to click on a link 72 72
that's going to download an agent onto their computer. 73 73
It's going to scan the device for compliance 74 74
and then delete itself from the user's machine 75 75
once it's done with the inspection. 76 76
If they pass the inspection, 77 77
there'll be granted access to the network, 78 78
if they're not, there'll be placed in a quarantine. 79 79
Network access control can be offered as either a hardware 80 80
or a software based solution when you're implementing it 81 81
inside your networks. 82 82
One of the most commonly used network access control 83 83
mechanisms is known as the IEEE standard 802.1x 84 84
which is port based network access control. 85 85
Most modern NACs are going to be built 86 86
on top of the 802.1x standard, 87 87
adding additional features and capabilities to it as well. 88 88
In addition to this NAC health policy, 89 89
where we're checking to make sure everybody meets 90 90
a minimum level of standard, 91 91
there could also be different rule-based methods 92 92
that you can use for granting or denying access 93 93
to your networks using NAC. 94 94
There's going to be more than just this health policy. 95 95
We can do it with lots of different things. 96 96
We can check things like the time, the location, 97 97
the role or rules to decide whether or not this device 98 98
should be granted entry to our network. 99 99
With time-based factors, 100 100
we're going to find access periods for given hosts, 101 101
using a time-based schedule. 102 102
For example, you might work in a company 103 103
that only operates from 9:00 in the morning, 104 104
till 5:00 in the afternoon. 105 105
And if you try to log in at 2:00 in the morning, 106 106
you're going to be denied access. 107 107
Now you have to be careful in using these time-based 108 108
approaches though, 109 109
or you could block legitimate access by mistake. 110 110
In my company, 111 111
we have employees that work on both sides of the world. 112 112
So when I'm sleeping at 2:00 in the morning here, 113 113
some of my employees are over in Asia and they're accessing 114 114
our networks and we need to make sure they can do their job. 115 115
So I can't block people at 2:00 in the morning. 116 116
But we could make it so they can only access things 117 117
during their daytime hours. 118 118
And we can only access things during our daytime hours. 119 119
If we want to use a time-based model. 120 120
Now, another way you can do things is 121 121
with location-based factors. 122 122
With location-based factors, 123 123
we're going to evaluate the location of the endpoint 124 124
requesting access using geolocation of its IP, 125 125
it's GPS or other mechanisms. 126 126
For example, if I know that one of my employees 127 127
always logs in from Florida, 128 128
but now all of a sudden they're logging in from Italy, 129 129
that would be something that will be flagged and we might 130 130
want to put them into remediation until we figure out, 131 131
are they really in Italy 132 132
or is it somebody attacking their account? 133 133
Now, after all, 134 134
maybe that person is on vacation and they're accessing their 135 135
work email from Italy and maybe they're not. 136 136
And somebody's actually hacked their account 137 137
and using their credentials. 138 138
So we need to validate that before we give them access 139 139
to the network, 140 140
both of these could be caught using location-based access. 141 141
Now another one we have is role-based factors, 142 142
and this is going to reevaluate a devices authentication 143 143
when it's being used to do something. 144 144
This is known as adaptive NAC. 145 145
Now, for example, let's say your device tries 146 146
to join a sub-net that's used for server management 147 147
and it's on the user account and a user laptop. 148 148
This should be rejected. 149 149
We shouldn't let that user account and user laptop connect 150 150
directly to our server management subnet. 151 151
But if I tried to connect a server to that domain, 152 152
it would allow that to happen because it's an authorized 153 153
function for that server based on its role. 154 154
Now, by using adaptive NAC, 155 155
we're going to be looking at the role of the device 156 156
and figuring out if it's doing something that it should 157 157
or should not be allowed to do. 158 158
And we can then adapt based on that. 159 159
The final one we have is rule-based factors, 160 160
and we can use a complex admission policy if we want to, 161 161
to enforce a series of rules. 162 162
And we basically can write these up with a bunch 163 163
of logical statements, if this, then that, 164 164
if this, then this other thing, 165 165
if this, then this third thing, 166 166
and we can make these things happen, for example, 167 167
if Jason and instructor let him access this folder, 168 168
if Jason and student deny him access, 169 169
that's the idea of this rule based mentality. 170 170
Now, this is obviously a very simple example, 171 171
but hopefully you're getting the idea of how you can create 172 172
rules to secure your network using network access control. 173 173
Our goal here is to make a policy based on a series of rules 174 174
and then allow or deny things to those people 175 175
based on the different conditions. 176 176
As you can see, NAC can be extremely useful 177 177
as part of our defense in-depth strategy, 178 178
and it helps to enforce a zero trust architecture 179 179
within our networks.