Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/25/2008
07:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NAC Plus Smart Switches Equals Better Control

New capabilities make the technology better than ever for access control and compliance reporting.

NAC started out as a simple concept--that it's a good idea to check the health and configuration of a system before allowing it to access a network.

Admission control is, as the name implies, a simple check at the gate. Once your ticket is punched, you're admitted to the network. Any further security checks are outside the scope of the admission-control system. While conceptually it might seem OK to use different technologies to police access at different stages of network and system use, the preponderance of industry and government compliance regulations make that less desirable. Compliance with regulations requires developing policies and enforcing them as consistently as possible across all of an organization's systems.

InformationWeek Reports

Relying on a variety of systems to consistently implement a single policy is not only administratively problematic, it's a reporting nightmare. And the thing that will keep regulators off your back is a full and complete auditable trail that details the who, what, when, and where of network access. So if you're going to keep those regulators happy, it's a good idea to employ as few broad-reaching systems as possible. That reality, along with some good old-fashioned ambition, has pushed NAC vendors to broaden the scope of what the technology does--including post-admission health monitoring and more detailed network and system access control.

Coherent policy enforcement and reporting are not the only challenges to simple NAC implementations--there's also the matter of who and what you're trying to protect against. One straightforward way to implement NAC is to intercept a system's request for an IP address and other information, and force the system to go through configuration verification before it's given its necessary network settings.

That keeps the honest users honest, but the protocol that normally doles out network configuration, namely DHCP, wasn't designed as a security policy enforcement system. Simply put, DHCP is easily subverted as an enforcement mechanism, whether through the use of static addresses or by other means, such as setting up a rogue DHCP server or modifying a computer's MAC address so that a rogue system is given access.

SWITCHES TO THE RESCUE
Particularly at admission time, any NAC implementation can benefit from the use of 802.1X. Commonly supported on access layer switches today, 802.1X provides a more complete authentication mechanism than simply matching up physical MAC addresses to IP addresses. Instead, supplicant software running on the node to be admitted verifies the identity of the user and other parameters such as system configuration.

DIG DEEPER
PUT TO THE TEST
We ran three in-band NAC systems throught their paces. Find out what we learned
Along with 802.1X, there are a number of features commonly available on access switches that can help harden a network against attack (see chart, p. 42). Some of these have nothing to do with NAC. For instance, many switches support DHCP snooping, which tracks DHCP exchanges and creates a database of hosts that have successfully completed DHCP, their MAC and IP addresses, and which ports they are attached to. DHCP snooping is most effective at the access switch, where only one host per port is allowed. DHCP snooping deeper in the network, such as at distribution or core switches, doesn't make sense since MAC and IP addresses may have been spoofed and hijacked at the access switch. Once the access switch builds its DHCP database, the information can be used to ensure that IP addresses don't move arbitrarily, as they would when spoofed.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13991
PUBLISHED: 2020-09-24
vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
CVE-2020-15160
PUBLISHED: 2020-09-24
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
CVE-2020-15162
PUBLISHED: 2020-09-24
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
CVE-2020-15843
PUBLISHED: 2020-09-24
ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client\, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal\. The folder permissions allow "Full Control" t...
CVE-2020-17365
PUBLISHED: 2020-09-24
Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially craf...