1
00:00:00,000 --> 00:00:01,620
In this lesson,

2
00:00:01,620 --> 00:00:04,890
we're going to talk about network access control.

3
00:00:04,890 --> 00:00:06,870
Network access control or NAC

4
00:00:06,870 --> 00:00:09,270
is used to protect your network from both known

5
00:00:09,270 --> 00:00:12,000
and unknown devices by scanning any devices

6
00:00:12,000 --> 00:00:14,040
to determine its current state of security

7
00:00:14,040 --> 00:00:17,130
prior to being allowed access to your network.

8
00:00:17,130 --> 00:00:19,560
Network access control can be used for computers

9
00:00:19,560 --> 00:00:21,480
that are within your internal network,

10
00:00:21,480 --> 00:00:23,190
that are physically located in your buildings

11
00:00:23,190 --> 00:00:25,830
and connected to it, or it can be applied to devices

12
00:00:25,830 --> 00:00:29,280
that are connected into your network remotely through a VPN.

13
00:00:29,280 --> 00:00:31,620
When a device attempts to connect to a network,

14
00:00:31,620 --> 00:00:33,870
it is placed into a virtual holding area

15
00:00:33,870 --> 00:00:35,370
while it's being scanned.

16
00:00:35,370 --> 00:00:38,070
This scan can be extremely simple, like verifying

17
00:00:38,070 --> 00:00:41,670
that it has the basic authentication using EAP, for example,

18
00:00:41,670 --> 00:00:43,800
or it can be more intense.

19
00:00:43,800 --> 00:00:45,330
For example, the device can be checked

20
00:00:45,330 --> 00:00:46,650
for a number of different factors,

21
00:00:46,650 --> 00:00:49,320
including its antivirus definitions to make sure

22
00:00:49,320 --> 00:00:52,170
that they're up to date, the status of the security patching

23
00:00:52,170 --> 00:00:54,840
and other items that might introduce security threats

24
00:00:54,840 --> 00:00:57,243
into the network if you allowed it to connect.

25
00:00:58,110 --> 00:01:00,480
If a device passes this inspection,

26
00:01:00,480 --> 00:01:02,790
it is then allowed to enter and receive access

27
00:01:02,790 --> 00:01:04,620
to all of the organizational resources

28
00:01:04,620 --> 00:01:06,630
that are provided by your network.

29
00:01:06,630 --> 00:01:08,790
If the device fails the inspection though,

30
00:01:08,790 --> 00:01:11,490
it is instead placed into a digital quarantine area

31
00:01:11,490 --> 00:01:13,320
and it awaits remediation.

32
00:01:13,320 --> 00:01:14,760
While it is in this area,

33
00:01:14,760 --> 00:01:16,950
device can receive its antivirus updates,

34
00:01:16,950 --> 00:01:18,810
it can get its operating system patches

35
00:01:18,810 --> 00:01:21,000
and any other security configurations

36
00:01:21,000 --> 00:01:22,650
and services that it might need.

37
00:01:22,650 --> 00:01:24,480
But it can't logically communicate

38
00:01:24,480 --> 00:01:25,680
with other parts of the network

39
00:01:25,680 --> 00:01:28,470
because it is trapped inside of the screened subnet

40
00:01:28,470 --> 00:01:30,600
that is reserved for quarantine devices.

41
00:01:30,600 --> 00:01:33,780
Like a bad child, the device has been placed in timeout

42
00:01:33,780 --> 00:01:36,750
until it can be rehabilitated and meet the requirements

43
00:01:36,750 --> 00:01:39,120
of the initial NAC inspection.

44
00:01:39,120 --> 00:01:41,640
Once it successfully meets those requirements,

45
00:01:41,640 --> 00:01:43,260
it is then moved into the network

46
00:01:43,260 --> 00:01:45,810
and receives full access again

47
00:01:45,810 --> 00:01:48,090
to your organizational resources.

48
00:01:48,090 --> 00:01:51,000
NAC solutions can run either using persistent

49
00:01:51,000 --> 00:01:52,740
or non-persistent agents.

50
00:01:52,740 --> 00:01:54,780
Persistent agents are a piece of software

51
00:01:54,780 --> 00:01:56,460
that's installed on a device

52
00:01:56,460 --> 00:01:58,230
that's requesting access to the network.

53
00:01:58,230 --> 00:02:00,180
This works well in a corporate environment

54
00:02:00,180 --> 00:02:02,520
because the organization owns all the devices

55
00:02:02,520 --> 00:02:04,200
and controls their software baselines.

56
00:02:04,200 --> 00:02:05,934
But it doesn't work really well if you use it

57
00:02:05,934 --> 00:02:08,880
in an environment where people bring their own devices.

58
00:02:08,880 --> 00:02:10,350
Instead, you might want to use

59
00:02:10,350 --> 00:02:12,180
a non-persistent agent for this.

60
00:02:12,180 --> 00:02:14,370
A non-persistent agent solution is very popular

61
00:02:14,370 --> 00:02:17,160
in college campuses where people bring their own devices

62
00:02:17,160 --> 00:02:19,110
and connect them to the network.

63
00:02:19,110 --> 00:02:20,670
These solutions require the users

64
00:02:20,670 --> 00:02:23,100
to connect to a network, usually over Wi-Fi,

65
00:02:23,100 --> 00:02:25,440
and then they go to a web-based captive portal

66
00:02:25,440 --> 00:02:27,840
for login and they have to click a link.

67
00:02:27,840 --> 00:02:30,780
Once they click that link, the link then downloads an agent

68
00:02:30,780 --> 00:02:33,390
onto the computer, scans the device for compliance

69
00:02:33,390 --> 00:02:35,370
and deletes itself from the user machine,

70
00:02:35,370 --> 00:02:37,140
once it's done with the inspection.

71
00:02:37,140 --> 00:02:39,000
Network access control can be offered

72
00:02:39,000 --> 00:02:40,950
as a hardware or software solution

73
00:02:40,950 --> 00:02:43,470
when being implemented in your networks.

74
00:02:43,470 --> 00:02:44,880
One of the most commonly used

75
00:02:44,880 --> 00:02:47,100
network access control mechanisms is called

76
00:02:47,100 --> 00:02:50,670
IEEE Standard 802.1x, which is used

77
00:02:50,670 --> 00:02:53,610
in a port-based network access control.

78
00:02:53,610 --> 00:02:55,860
Most modern NACs will be built up on top

79
00:02:55,860 --> 00:02:58,830
of the 802.1x standard using additional features

80
00:02:58,830 --> 00:03:00,270
and capabilities as well.

81
00:03:00,270 --> 00:03:02,280
In addition to the NAC health policy,

82
00:03:02,280 --> 00:03:04,590
there can also be different rule-based methods

83
00:03:04,590 --> 00:03:05,790
that you can use for granting

84
00:03:05,790 --> 00:03:08,490
or denying access to your network using NAC.

85
00:03:08,490 --> 00:03:10,680
There's more than just a health policy though.

86
00:03:10,680 --> 00:03:13,770
This includes things like time, location, role,

87
00:03:13,770 --> 00:03:16,020
or rule-based methods to check a device

88
00:03:16,020 --> 00:03:18,090
for entry to the network.

89
00:03:18,090 --> 00:03:19,410
With time-based factors,

90
00:03:19,410 --> 00:03:22,650
we will define access periods using a time-based schedule.

91
00:03:22,650 --> 00:03:24,360
For example, you might work in a company

92
00:03:24,360 --> 00:03:26,190
that only operates from nine to five,

93
00:03:26,190 --> 00:03:27,960
so if you try to log in at two in the morning,

94
00:03:27,960 --> 00:03:30,150
you could be denied access.

95
00:03:30,150 --> 00:03:31,710
You have to be careful when you implement

96
00:03:31,710 --> 00:03:34,290
these time-based approaches since you could end up blocking

97
00:03:34,290 --> 00:03:36,150
legitimate access by mistake.

98
00:03:36,150 --> 00:03:37,530
In our company, we have employees

99
00:03:37,530 --> 00:03:39,330
who work on both sides of the world.

100
00:03:39,330 --> 00:03:41,430
And so, while I'm sleeping here at two in the morning,

101
00:03:41,430 --> 00:03:43,500
some of the employees are over in Asia

102
00:03:43,500 --> 00:03:45,360
trying to access our networks.

103
00:03:45,360 --> 00:03:47,790
We can make it so that they can only access our systems

104
00:03:47,790 --> 00:03:50,640
during their daytime hours and that we can only access

105
00:03:50,640 --> 00:03:52,470
our systems during our daytime hours

106
00:03:52,470 --> 00:03:54,840
if we want to use a time-based model.

107
00:03:54,840 --> 00:03:56,340
With location-based factors,

108
00:03:56,340 --> 00:03:58,950
we're going to evaluate the location of the endpoint

109
00:03:58,950 --> 00:04:02,250
requesting access using geolocation of its IP,

110
00:04:02,250 --> 00:04:04,260
its GPS or other mechanism.

111
00:04:04,260 --> 00:04:06,630
For example, if I know that one of the employees

112
00:04:06,630 --> 00:04:09,210
always logs in from Florida, but now all of a sudden,

113
00:04:09,210 --> 00:04:11,580
their logging credentials are being logged in from Italy,

114
00:04:11,580 --> 00:04:13,500
that would be something that would be flagged,

115
00:04:13,500 --> 00:04:15,300
and we might put them into remediation

116
00:04:15,300 --> 00:04:17,700
until we figure out if they're really the right person.

117
00:04:17,700 --> 00:04:19,950
After all, maybe that person is on vacation

118
00:04:19,950 --> 00:04:22,019
and they're accessing their work email from Italy,

119
00:04:22,019 --> 00:04:23,610
or maybe someone hacked their credentials

120
00:04:23,610 --> 00:04:25,920
and they're trying to log in as them.

121
00:04:25,920 --> 00:04:27,840
Both of those would be things that we could catch

122
00:04:27,840 --> 00:04:30,540
using location-based access.

123
00:04:30,540 --> 00:04:31,920
With role-based factors,

124
00:04:31,920 --> 00:04:34,260
we can reevaluate a device authorization

125
00:04:34,260 --> 00:04:36,450
when it's being used to do something.

126
00:04:36,450 --> 00:04:38,970
This is known as adaptive NAC.

127
00:04:38,970 --> 00:04:41,760
For example, if your device tries to join a subnet

128
00:04:41,760 --> 00:04:44,730
that's used for server management and it's on a user account

129
00:04:44,730 --> 00:04:48,000
and a user laptop, it should be rejected.

130
00:04:48,000 --> 00:04:50,430
But if I try to connect a server to the domain,

131
00:04:50,430 --> 00:04:51,780
it will allow that to happen

132
00:04:51,780 --> 00:04:53,490
because that is an authorized function

133
00:04:53,490 --> 00:04:55,173
based on the role of that device.

134
00:04:56,010 --> 00:04:57,690
By using this adaptive NAC,

135
00:04:57,690 --> 00:04:59,760
we're able to look at the role of the device

136
00:04:59,760 --> 00:05:01,590
and figure out if it's something that it should

137
00:05:01,590 --> 00:05:03,510
or should not be allowed to do.

138
00:05:03,510 --> 00:05:04,590
With rule-based factors,

139
00:05:04,590 --> 00:05:06,930
we can use a complex admission-based policy

140
00:05:06,930 --> 00:05:08,550
that might enforce a series of rules,

141
00:05:08,550 --> 00:05:10,080
and we basically write them

142
00:05:10,080 --> 00:05:11,880
with a bunch of logical statements.

143
00:05:11,880 --> 00:05:16,880
If this, then this, if this and this, if this or this.

144
00:05:17,100 --> 00:05:20,340
For example, if Jamario is an instructor,

145
00:05:20,340 --> 00:05:22,110
let him access this thing.

146
00:05:22,110 --> 00:05:24,930
If Jamario is a student, deny him access.

147
00:05:24,930 --> 00:05:26,850
That's the idea of a rule-based NAC.

148
00:05:26,850 --> 00:05:29,280
Now, that's obviously a very simple example,

149
00:05:29,280 --> 00:05:30,780
but hopefully you get the idea.

150
00:05:30,780 --> 00:05:33,600
Our goal is to make policies based on series of rules

151
00:05:33,600 --> 00:05:37,380
and then allow or deny people based on those things.

152
00:05:37,380 --> 00:05:41,310
So remember, network access control or NAC

153
00:05:41,310 --> 00:05:43,260
is used to protect your network from both known

154
00:05:43,260 --> 00:05:46,110
and unknown devices by scanning any devices

155
00:05:46,110 --> 00:05:48,450
to determine their current state of security

156
00:05:48,450 --> 00:05:50,820
prior to being allowed access to your network.

157
00:05:50,820 --> 00:05:53,130
As you can see, NAC is very useful

158
00:05:53,130 --> 00:05:55,380
as part of our defense in-depth strategy

159
00:05:55,380 --> 00:05:57,480
and helps to enforce a zero trust architecture

160
00:05:57,480 --> 00:05:58,480
within our networks.