Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/25/2008
07:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

NAC Plus Smart Switches Equals Better Control

New capabilities make the technology better than ever for access control and compliance reporting.

NAC started out as a simple concept--that it's a good idea to check the health and configuration of a system before allowing it to access a network.

Admission control is, as the name implies, a simple check at the gate. Once your ticket is punched, you're admitted to the network. Any further security checks are outside the scope of the admission-control system. While conceptually it might seem OK to use different technologies to police access at different stages of network and system use, the preponderance of industry and government compliance regulations make that less desirable. Compliance with regulations requires developing policies and enforcing them as consistently as possible across all of an organization's systems.

InformationWeek Reports

Relying on a variety of systems to consistently implement a single policy is not only administratively problematic, it's a reporting nightmare. And the thing that will keep regulators off your back is a full and complete auditable trail that details the who, what, when, and where of network access. So if you're going to keep those regulators happy, it's a good idea to employ as few broad-reaching systems as possible. That reality, along with some good old-fashioned ambition, has pushed NAC vendors to broaden the scope of what the technology does--including post-admission health monitoring and more detailed network and system access control.

Coherent policy enforcement and reporting are not the only challenges to simple NAC implementations--there's also the matter of who and what you're trying to protect against. One straightforward way to implement NAC is to intercept a system's request for an IP address and other information, and force the system to go through configuration verification before it's given its necessary network settings.

That keeps the honest users honest, but the protocol that normally doles out network configuration, namely DHCP, wasn't designed as a security policy enforcement system. Simply put, DHCP is easily subverted as an enforcement mechanism, whether through the use of static addresses or by other means, such as setting up a rogue DHCP server or modifying a computer's MAC address so that a rogue system is given access.

SWITCHES TO THE RESCUE
Particularly at admission time, any NAC implementation can benefit from the use of 802.1X. Commonly supported on access layer switches today, 802.1X provides a more complete authentication mechanism than simply matching up physical MAC addresses to IP addresses. Instead, supplicant software running on the node to be admitted verifies the identity of the user and other parameters such as system configuration.

DIG DEEPER
PUT TO THE TEST
We ran three in-band NAC systems throught their paces. Find out what we learned
Along with 802.1X, there are a number of features commonly available on access switches that can help harden a network against attack (see chart, p. 42). Some of these have nothing to do with NAC. For instance, many switches support DHCP snooping, which tracks DHCP exchanges and creates a database of hosts that have successfully completed DHCP, their MAC and IP addresses, and which ports they are attached to. DHCP snooping is most effective at the access switch, where only one host per port is allowed. DHCP snooping deeper in the network, such as at distribution or core switches, doesn't make sense since MAC and IP addresses may have been spoofed and hijacked at the access switch. Once the access switch builds its DHCP database, the information can be used to ensure that IP addresses don't move arbitrarily, as they would when spoofed.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21981
PUBLISHED: 2021-04-19
VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of this issue may allow attackers with local guest user account to assign privileges higher than their own permission level.
CVE-2021-20989
PUBLISHED: 2021-04-19
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be us...
CVE-2021-20990
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.
CVE-2021-20991
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability.
CVE-2021-20992
PUBLISHED: 2021-04-19
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.