Cyberstudy
PDF p.251 In progress

Network Access Control (NAC)

Open PDF at p.251 18 flashcards

Summary

PDF p.251

Network Access Control (NAC) authenticates users and devices before allowing network access and ensures compliance with security policies. It evaluates various security parameters and can restrict access based on user profiles, device types, and other attributes.

In plain words

Supplementary — not from your PDF

Network access control (NAC) checks users and devices before letting them on, and checks their health (OS version, patches, antivirus) against policy. Compliant devices get the right VLAN; non-compliant ones go to a quarantine VLAN to be fixed. Agent-based NAC (persistent or dissolvable agents) can inspect deeply and even auto-remediate. Agentless NAC uses scans or DHCP fingerprinting and works for guests and IoT.

Detailed explanation

PDF p.251
  • Authentication and Compliance: NAC checks operating system versions, patch levels, antivirus status, and specific security software presence to ensure devices meet security standards.
  • Access Restrictions: Based on user profiles, device types, locations, and other attributes to ensure appropriate access.
  • BYOD and IoT Security: NAC is crucial for securing networks with bring-your-own-device (BYOD) policies and IoT devices.

NAC and VLAN Integration

  • Dynamic VLAN Assignment: Assigns VLANs based on user identity, device type, location, or health check results.
  • Quarantine VLANs: Isolates noncompliant devices to limit potential damage from threats.

Agent vs. Agentless Configurations

  • Agent-Based NAC
    • Persistent Agents: Installed as software applications on clients.
    • Nonpersistent Agents: Loaded into memory during posture assessment.
    • Automatic Remediation: Agents can update software or disable settings to ensure compliance.
  • Agentless NAC
    • Port-Based Control: Uses network scans or DHCP fingerprinting to evaluate devices.
    • Broad Compatibility: Works with any device, including guest or IoT devices, without prior configuration.

Important terms

taken from the text above
Authentication and Compliance
NAC checks operating system versions, patch levels, antivirus status, and specific security software presence to ensure devices meet security standards.
Access Restrictions
Based on user profiles, device types, locations, and other attributes to ensure appropriate access.
BYOD and IoT Security
NAC is crucial for securing networks with bring-your-own-device (BYOD) policies and IoT devices.
Dynamic VLAN Assignment
Assigns VLANs based on user identity, device type, location, or health check results.
Quarantine VLANs
Isolates noncompliant devices to limit potential damage from threats.
Persistent Agents
Installed as software applications on clients.
Nonpersistent Agents
Loaded into memory during posture assessment.
Automatic Remediation
Agents can update software or disable settings to ensure compliance.
Port-Based Control
Uses network scans or DHCP fingerprinting to evaluate devices.
Broad Compatibility
Works with any device, including guest or IoT devices, without prior configuration.
NAC Network Access Control

Examples & real-world scenarios

Supplementary — not from your PDF
  • A laptop missing patches placed in a quarantine VLAN until it updates.
  • Guest phones profiled by DHCP fingerprinting and given Internet-only access.
  • A persistent NAC agent reporting antivirus status.

Scenario

A contractor's laptop with outdated antivirus connects to the network. NAC detects the failed health check and assigns it to a remediation VLAN instead of the production network.

Common mistakes

Supplementary — not from your PDF
  • Thinking NAC only checks passwords. It also checks device posture.
  • Mixing up persistent agents (installed) and nonpersistent (dissolvable) agents.

Practical skills

Supplementary — not from your PDF
  • Design NAC rules with quarantine and dynamic VLAN assignment.

What I should remember

Key Points PDF p.251
  • NAC Functions
    • Authentication: Ensures only valid users and devices access the network.
    • Compliance Checks: Evaluates security parameters like OS version and antivirus status.
    • Access Control: Restricts access based on user profiles and device attributes.
  • Dynamic VLAN Assignment
    • User-Based VLANs: Assigns VLANs based on user identity and device health.
    • Quarantine Procedures: Isolates noncompliant devices in a quarantine VLAN.
  • Agent-Based vs. Agentless NAC
    • Agent-Based: Provides detailed device information and automatic remediation.
    • Agentless: Uses network scans and is compatible with all devices.