Risk
6/25/2008
07:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NAC Plus Smart Switches Equals Better Control

New capabilities make the technology better than ever for access control and compliance reporting.

NAC started out as a simple concept--that it's a good idea to check the health and configuration of a system before allowing it to access a network.

Admission control is, as the name implies, a simple check at the gate. Once your ticket is punched, you're admitted to the network. Any further security checks are outside the scope of the admission-control system. While conceptually it might seem OK to use different technologies to police access at different stages of network and system use, the preponderance of industry and government compliance regulations make that less desirable. Compliance with regulations requires developing policies and enforcing them as consistently as possible across all of an organization's systems.

InformationWeek Reports

Relying on a variety of systems to consistently implement a single policy is not only administratively problematic, it's a reporting nightmare. And the thing that will keep regulators off your back is a full and complete auditable trail that details the who, what, when, and where of network access. So if you're going to keep those regulators happy, it's a good idea to employ as few broad-reaching systems as possible. That reality, along with some good old-fashioned ambition, has pushed NAC vendors to broaden the scope of what the technology does--including post-admission health monitoring and more detailed network and system access control.

Coherent policy enforcement and reporting are not the only challenges to simple NAC implementations--there's also the matter of who and what you're trying to protect against. One straightforward way to implement NAC is to intercept a system's request for an IP address and other information, and force the system to go through configuration verification before it's given its necessary network settings.

That keeps the honest users honest, but the protocol that normally doles out network configuration, namely DHCP, wasn't designed as a security policy enforcement system. Simply put, DHCP is easily subverted as an enforcement mechanism, whether through the use of static addresses or by other means, such as setting up a rogue DHCP server or modifying a computer's MAC address so that a rogue system is given access.

SWITCHES TO THE RESCUE
Particularly at admission time, any NAC implementation can benefit from the use of 802.1X. Commonly supported on access layer switches today, 802.1X provides a more complete authentication mechanism than simply matching up physical MAC addresses to IP addresses. Instead, supplicant software running on the node to be admitted verifies the identity of the user and other parameters such as system configuration.

DIG DEEPER
PUT TO THE TEST
We ran three in-band NAC systems throught their paces. Find out what we learned
Along with 802.1X, there are a number of features commonly available on access switches that can help harden a network against attack (see chart, p. 42). Some of these have nothing to do with NAC. For instance, many switches support DHCP snooping, which tracks DHCP exchanges and creates a database of hosts that have successfully completed DHCP, their MAC and IP addresses, and which ports they are attached to. DHCP snooping is most effective at the access switch, where only one host per port is allowed. DHCP snooping deeper in the network, such as at distribution or core switches, doesn't make sense since MAC and IP addresses may have been spoofed and hijacked at the access switch. Once the access switch builds its DHCP database, the information can be used to ensure that IP addresses don't move arbitrarily, as they would when spoofed.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.