NAC Director is an appliance that sits on the perimeter of the network and notes all users attempting to enter the network. Each user has an agent on their computer that can be either persistent or dissolvable.
Persistent agents are deployed to regular employees and contractors who enter the network routinely, while dissolvable agents are appropriate for ad hoc visitors to the network. Agents are tied to MAC addresses.
NAC Director has three important features that make it unique. First, it has an unprecedented breadth of supported devices, including at least 20 network vendors and a wide variety of security applications (anti-virus, anti-spyware, operating system) and allowed or prohibited applications, configurations and revision levels.
The second unique feature is its ability to be deployed in a wired, wireless or VPN environment. This is very important because today’s enterprises are likely to contain all three. Finally, NAC Director integrates easily with your existing enterprise infrastructure.
When a new user accesses the network for the first time, an agent is placed on the user’s computer. That agent may be persistent or dissolvable. The user is assigned to specific groups, each of which enforces assigned usage policies.
Users are identified by what Bradford calls its 7-Point Identity Profile. This profile includes the user’s name or ID, the device’s name, MAC address and IP address, the user’s role, the place on the network from which the user is accessing the enterprise, and the time of day.
NAC Director has several safeguards that check users as they log in. First, users’ computers are validated to ensure that they are not violating any of the 7-point profile elements. If they are in violation, or if they match a known stolen device, NAC Director can apply its Get Out/Stay Out control.
Devices accessing the enterprise may be scanned for vulnerabilities using the popular Nessus scanner. Finally, NAC Director checks for processes running on the accessing computer and ensures that only those allowed are running.
Once NAC Director determines that the user is welcome on the network, the next step is to apply policies for the user’s role or group. These can assign the user to a particular VLAN and/or route to an individual port.
If a user is out of compliance, they may be directed to resources that can assist in self-remediation, simplifying administration and use for administrators and users alike.
NAC Director has comprehensive reporting and alarming. Reports may be customised, but the product comes with several standard reports pre-configured.
For high security applications, NAC Director can integrate IDS/IPS systems that perform deep packet inspection. Reports easily support compliance with regulatory requirements, such as SOX, HIPAA and GLBA.
Initial deployment of the appliance consists of installation and subsequent discovery of all of the devices on the enterprise. When the user accesses the network, NAC Director performs its functions, and if the user’s machine is in violation of policies, NAC Director reports to the appropriate device and dictates the actions per the violated policy.
The device then responds by following NAC Director’s orders and either forces the user to perform remediation or excludes the user from the enterprise.
I found NAC Director to be acceptably easy to deploy, well documented and well supported. The breadth of supported devices and security programs coupled with its robust feature set are enhanced by its out-of-band implementation.
Pricing starts at US$6,495, which is extremely reasonable for a product of this type, especially given its unique qualities.
The Bradford Networks website is a feast of information, including data sheets, features and benefits charts, a knowledge bank, white papers, interoperability guides, product manuals, FAQs and application notes.
Prior to reviewing NAC Director, we received a comprehensive online demo complete with the opportunity to play around with the product and question qualified engineers. As always, one question related to whether Bradford Networks supplies this level of pre-sales support to potential customers.
We were assured that all customers get the same treatment that we did. Because there are several unique aspects to the product, we appreciated the direct contact with NAC Director experts and a chance for supervised hands-on instruction before we got deeply into the product.
This is a well-thought-out product from a pioneering company that’s been in the business of NAC since 2002. In addition to the NAC Director, the company offers a broad suite of implementation, customization and training services. When it comes to a comprehensive NAC product, NAC Director is the real McCoy.
— Peter Stephenson
AT A GLANCE:
Product: NAC Director v3.1.7
Company: Bradford Networks
Availability: Now
Price: Starting at US$6,495
What it does: Manages network access control across wired, wireless and VPN implementations for access to a very wide variety of network devices, software products and security prodcuts and services.
What we liked: Breadth of supported devices, comprehensive environments supported, out-of-band deployment, as well as depth of analysis of devices attempting to access the enterprise.
What we didn't like: Nothing. This one's a winner from start to finish.
See original article on SC Magazine US
There are three important functions of network access control (NAC) systems.
.png&h=183&w=300&c=1&s=0)
.jpg&h=146&w=240&c=1&s=0)
