In this lesson,
we're going to talk about network access control.
Network access control or NAC
is used to protect your network from both known
and unknown devices by scanning any devices
to determine its current state of security
prior to being allowed access to your network.
Network access control can be used for computers
that are within your internal network,
that are physically located in your buildings
and connected to it, or it can be applied to devices
that are connected into your network remotely through a VPN.
When a device attempts to connect to a network,
it is placed into a virtual holding area
while it's being scanned.
This scan can be extremely simple, like verifying
that it has the basic authentication using EAP, for example,
or it can be more intense.
For example, the device can be checked
for a number of different factors,
including its antivirus definitions to make sure
that they're up to date, the status of the security patching
and other items that might introduce security threats
into the network if you allowed it to connect.
If a device passes this inspection,
it is then allowed to enter and receive access
to all of the organizational resources
that are provided by your network.
If the device fails the inspection though,
it is instead placed into a digital quarantine area
and it awaits remediation.
While it is in this area,
device can receive its antivirus updates,
it can get its operating system patches
and any other security configurations
and services that it might need.
But it can't logically communicate
with other parts of the network
because it is trapped inside of the screened subnet
that is reserved for quarantine devices.
Like a bad child, the device has been placed in timeout
until it can be rehabilitated and meet the requirements
of the initial NAC inspection.
Once it successfully meets those requirements,
it is then moved into the network
and receives full access again
to your organizational resources.
NAC solutions can run either using persistent
or non-persistent agents.
Persistent agents are a piece of software
that's installed on a device
that's requesting access to the network.
This works well in a corporate environment
because the organization owns all the devices
and controls their software baselines.
But it doesn't work really well if you use it
in an environment where people bring their own devices.
Instead, you might want to use
a non-persistent agent for this.
A non-persistent agent solution is very popular
in college campuses where people bring their own devices
and connect them to the network.
These solutions require the users
to connect to a network, usually over Wi-Fi,
and then they go to a web-based captive portal
for login and they have to click a link.
Once they click that link, the link then downloads an agent
onto the computer, scans the device for compliance
and deletes itself from the user machine,
once it's done with the inspection.
Network access control can be offered
as a hardware or software solution
when being implemented in your networks.
One of the most commonly used
network access control mechanisms is called
IEEE Standard 802.1x, which is used
in a port-based network access control.
Most modern NACs will be built up on top
of the 802.1x standard using additional features
and capabilities as well.
In addition to the NAC health policy,
there can also be different rule-based methods
that you can use for granting
or denying access to your network using NAC.
There's more than just a health policy though.
This includes things like time, location, role,
or rule-based methods to check a device
for entry to the network.
With time-based factors,
we will define access periods using a time-based schedule.
For example, you might work in a company
that only operates from nine to five,
so if you try to log in at two in the morning,
you could be denied access.
You have to be careful when you implement
these time-based approaches since you could end up blocking
legitimate access by mistake.
In our company, we have employees
who work on both sides of the world.
And so, while I'm sleeping here at two in the morning,
some of the employees are over in Asia
trying to access our networks.
We can make it so that they can only access our systems
during their daytime hours and that we can only access
our systems during our daytime hours
if we want to use a time-based model.
With location-based factors,
we're going to evaluate the location of the endpoint
requesting access using geolocation of its IP,
its GPS or other mechanism.
For example, if I know that one of the employees
always logs in from Florida, but now all of a sudden,
their logging credentials are being logged in from Italy,
that would be something that would be flagged,
and we might put them into remediation
until we figure out if they're really the right person.
After all, maybe that person is on vacation
and they're accessing their work email from Italy,
or maybe someone hacked their credentials
and they're trying to log in as them.
Both of those would be things that we could catch
using location-based access.
With role-based factors,
we can reevaluate a device authorization
when it's being used to do something.
This is known as adaptive NAC.
For example, if your device tries to join a subnet
that's used for server management and it's on a user account
and a user laptop, it should be rejected.
But if I try to connect a server to the domain,
it will allow that to happen
because that is an authorized function
based on the role of that device.
By using this adaptive NAC,
we're able to look at the role of the device
and figure out if it's something that it should
or should not be allowed to do.
With rule-based factors,
we can use a complex admission-based policy
that might enforce a series of rules,
and we basically write them
with a bunch of logical statements.
If this, then this, if this and this, if this or this.
For example, if Jamario is an instructor,
let him access this thing.
If Jamario is a student, deny him access.
That's the idea of a rule-based NAC.
Now, that's obviously a very simple example,
but hopefully you get the idea.
Our goal is to make policies based on series of rules
and then allow or deny people based on those things.
So remember, network access control or NAC
is used to protect your network from both known
and unknown devices by scanning any devices
to determine their current state of security
prior to being allowed access to your network.
As you can see, NAC is very useful
as part of our defense in-depth strategy
and helps to enforce a zero trust architecture
within our networks.