Organizations with significant use of Guest networks could implement a Comply to Connect (C2C) solution to enforce granular security requirements for external devices.

Control Type: Technical

Control Function: Preventive

The previous documentation discussed the concept of Network Access Control (NAC), and its power in securing modern, perimeterless networks. Organizations are encouraged to explore implementing a NAC solution along with 802.1X user authentication for their internal enterprise networks.

NAC can also be applied to a Guest network scenario. Depending on the specific services an organization offers, there may be a need to offer extensive guest network access. Such networks have long been a security headache, as the ability to properly supervise and manage endpoints from the ground up is hampered, since the organization does not have autonomy over the devices being used to access their network. Outdated and unsecured systems can spread malware, worms, and trojans throughout the guest network, either intentionally or unintentionally. This creates a difficult and excruciating experience for the organization, who holds responsibility for the use of their Guest WiFi.

Using NAC solutions, organizations can implement a Comply to Connect (C2C) policy for their Guest WiFi. C2C is a US Department of Defense approach to securing network access that has broad applicability to all sectors and business sizes. The overarching goal is to grant network access to users with the tradeoff that their devices must meet specific standards outlined by the organization. Oftentimes, organizations will provide non-compliant devices with the opportunity to visit a screened subnet and have their devices configured to meet the proper compliance standards.

The level of sophistication employed in a C2C strategy is organizationally defined and can range from basic security checks to granular control and segmentation. Some of the possible features for C2C include:

  • Verification of identity. Before systems can be granted access, the organization can require the end user to register with the organization, typically through a form on a captive portal. Required fields could include full name, email, nature of visit, phone number, etc. This helps the organization verify identities and create audit trails of network activity that can be mapped to a real-world identity.
  • MAC Address Whitelisting. The captive portal provided to users after initial connection could also be configured to require entering the device’s MAC address before access is granted. By having the user enter their MAC address, the C2C solution can create a whitelist of authorized MAC addresses. While this is a good way to cut down on unauthorized network access, it does not provide any attestation to device security and health.
  • Update Status. The organization can define a minimum update level for each major operating system. Devices that have not been updated to the minimum standard are denied access and possibly provided the opportunity to receive updates from a server in a screened subnet. An example would be requiring Windows systems to be on Windows 11 24h2 and later.
  • Malware & Vulnerability Scans. Devices can be scanned for the presence of malware and known vulnerabilities on the system. The organization can either completely deny access for the device or offer a remediation subnet to quarantine and remove the malware and remediate vulnerabilities that have publicly released patches available.
  • Dynamic VLAN Assignment. NAC solutions could dynamically assign devices to specific VLANs. Assignments could be based on attributes such as guest status, reason for visit, and even analytical data such as trust score. For example, visiting contractors could connect to the Guest WiFi and automatically be assigned to a VLAN providing limited access to certain resources like specific printers, web applications, etc. while regular walk-in visitors could be assigned to a completely isolated VLAN providing nothing but Internet access.
  • Real Time Alerting: An advanced C2C system could collaborate with third party vulnerability scanners, threat intelligence feeds, and intrusion detection systems to monitor activity on the guest network in real time. This allows constant monitoring of user activity against 24/7 threat intelligence to detect threats as they emerge. The process can be further automated to automatically quarantine and/or remove suspicious devices from the network before they can wreak havoc on the network.

Using reputable NAC solutions like PacketFence or Cisco ISE can be a great way to implement C2C for organizations with significant guest network use. It is important not to get too ambitious with the project out of the box, as this risks overreach on knowledge and potential scope creep. Organizations should carefully assess their business requirements and determine what is feasible for a C2C solution.