A Network Access Control (NAC) solution could be deployed to enforce device and user security compliance as a prerequisite for accessing the organization's network resources.

Control Type: Technical

Control Function: Preventive

Description: Network Access Control (NAC) is a handy network security control that helps enforce Zero Trust principles on networks that host many BYOD devices/VPN connections. End users authenticate to the network via a set of credentials that are validated through 802.1X, usually through a RADIUS Server. Authentication is required upfront, and devices that fail authentication will not be permitted network access. As a second line of defense, the security posture of the end device is assessed against organization-specified compliance standards. Requirements for compliance may include:

  • Antivirus software present
  • Host firewall enabled
  • Minimum OS version present
  • Latest OS patches installed
  • Device is signed with a recognized device certificate from a PKI

Many NAC solutions allow compliance requirements to be much more granular. In addition to the device status, the user status can be assessed. Attributers such as geolocation, time of day, user risk level, and login history can all be assessed by an identify engine to determine if the user side of the access attempt is trustworthy.

If the device and user pass the network checkpoint, they are then permitted access to the network. However, if they fail, NAC will deny the access attempt. If the login attempt was extremely suspicious, the device can be completely rejected from the network. The IP or MAC address of the device can even be blacklisted.

However, in many cases, the access attempt is legit, and the device is simply lacking some requirements, such as uninstalled Windows Updates or a disabled Windows Firewall. In such cases, the user can be redirected to a Screened Subnet that contains the necessary services to get the device up to compliance. Updates can be installed, remote device configuration can be performed, and anti-malware scans can be performed on the device to check for threats. If the device is able to be brought up to compliance, the user can be directed back to the NAC checkpoint to re-authentication and finally be granted access to the network.