In this lesson,
we're going to discuss Network Access Control.
Network Access Control, also known as N-A-C or NAC,
is a method for increasing the security
of a given network by inspecting devices
as they try to connect to a network
in order to determine if they're secure enough
to be granted access to that network.
Now, when it comes to NAC,
I like to think about it
like the passport and customs inspection point
that I use when I fly home from another country.
When I get up to the counter,
the immigration official will ask to see my passport,
and then they may ask the reason for my trip
and if I have any items to declare based on a set of rules
of what is and is not allowed
to be brought back into my country.
Basically, I am the network device in this example,
and I'm trying to join the network,
and in my case, I'm trying to reenter the country.
Now, if my documentation meets all the requirements
because I have a valid passport and an approved visa,
and my declarations are acceptable to the customs official,
I'm going to be granted access back into the country.
Now for any reason my documentation
or my declarations are not accepted,
I'm going to be placed into a special holding area
for additional screening or remediation,
such as waiting for somebody from the embassy
to come to the airport and help me clear customs
in the case of a significant error in my documentation.
So NAC is going to work in a very similar fashion,
because each device is going to present itself for inspection
when it first attempts to connect to the network.
This device is logically going to be isolated
from the rest of the network
and then inspected based on your NAC configurations.
This inspection can include the use of port security,
MAC filtering or 802.1x authentication
as part of your NAC inspection process,
and if your device fails that inspection,
it can be placed into a quarantine area,
which is a digital holding area
where that device will remain
until it can update its security posture
and pass the inspection to move from the quarantine segment
out into the rest of the production network.
Now, let's talk about each of these things.
First, we have port security.
Now, port security involves
securing your physical network ports
to prevent unauthorized access to those ports.
Port security adds an extra layer of defense
by limiting the number of devices
that can connect to a network switch or hub.
The port security mechanism can be configured to allow
only a specific MAC address to access a port
or some set of specified MAC addresses to access those ports
or provide even more granular control
over your network entry points if you need to.
This brings us to our second area we need to discuss,
which is known as MAC filtering.
Now, MAC filtering is going to control access to your network
by limiting which devices can gain access to the network
based on their device's unique MAC address.
By maintaining a list of approved MAC addresses,
your network administrators can ensure
that only recognized devices
can connect to your network infrastructure,
such as your switches.
Now, this approach is also known as "allowlisting"
and it's particularly useful in environments
where device consistency is going to be high
and unknown devices could pose a significant risk
to your security.
Alternatively, many devices allow us
to configure MAC filtering by using a blocklisting instead.
With a blocklist setting,
every device is going to be allowed to connect to your network
except those devices whose MAC addresses
you added to the MAC filtering list.
Basically, this is the reverse of allowlisting,
and it's considered less secure than allowlisting
because you're just blocking people who you know are bad
instead of only allowing people who you know are good.
Now with allowlisting,
we're only going to allow devices that we specify
and we're going to block everyone else.
But with blocklisting,
we're only going to block the devices you specify,
and we're going to allow everybody else into the network.
Now, the third thing we have,
it's what's known as 802.1x authentication.
802.1x authentication provides an authentication framework
for networks that ensures only authenticated users
can access network services.
This protocol works by encapsulating
the extensible authentication protocol,
also known as EAP, within your network's frames
to be able to enable more robust authentication mechanisms
like the use of usernames and passwords, smart cards,
or digital certificates.
The 802.1x authentication process typically involves
three components: the supplicant, the authenticator,
and the authentication server.
The supplicant is a user device
that's seeking to access your network.
The authenticator is the network device
that the user wants to connect to,
like your switches or a wireless access point.
And the authentication server is a server on the network
that's going to authenticate your user device's username,
password, smart card, or digital certificate,
to validate they are authorized to connect to your network.
Most commonly, we're going to do this using a radius server,
which is a remote access dialing user service server
as the authentication server.
Now, whenever a device attempts to connect to the network,
the authenticator is going to act like a gatekeeper
to block all traffic
except the 802.1x authentication traffic
that's being sent by the user's device.
Upon successful authentication,
that server is going to instruct the authenticator
to open the virtual gate in order to allow the user's device
to begin sending normal data traffic to and through
that network.
This method is going to strengthen your network security
by ensuring that only authenticated devices
can access the network,
and it provides a scalable solution that can be integrated
into modern and diverse network infrastructures.
Now that we've covered the basics of NAC,
let's take a look at how it can be implemented
inside of your own networks.
Now, let's pretend that you work for an organization
that allows its employees to either use
the company provided desktop in their office,
or they could bring in their own smartphones and laptops
to the office and connect those personal devices
to the organization's network
to perform their work functions.
Now, if a user's going to use a personally owned device,
they're going to have to follow the organization's
"bring your own device" policy,
because this will tell users what security requirements
must be met in order for their devices
to be allowed onto the organization's network.
The organization may decide to use
a combination of port security, MAC filtering, and 802.1x
to ensure that each device
meets its strict security requirements
before it can access the organization's larger network
after it's been inspected using network access control.
In order to check each device that connects to the network,
we're either going to use a persistent
or a non-persistent agent.
For the company-provided computers,
we're usually going to install persistent agents
on these devices because these persistent agents
can continuously monitor and enforce compliance
with our organization's security policies,
and we own those devices, after all,
so we can install whatever software we want,
like a persistent agent on it.
For the user's personally owned devices, though,
we often aren't allowed to install software on those devices
for legal reasons,
so instead, we're going to opt to use a non-persistent agent.
Now, a non-persistent agent allows users
to connect to the network, such as a wifi network,
and then access a captive portal.
Once you're at the captive portal,
it's going to ask the user to run a temporary agent
that assesses the device's compliance,
and then it removes itself
after the compliance scan was completed.
So when a device is connected to the network,
the persistent or non-persistent agent is first going to check
if the MAC address of that device is on the approved list,
and then it will verify the device's identity
using the 802.1x protocol.
If either of those two checks fail,
that device will either be denied access to the network
or it'll be placed into a special quarantine zone
for further remediation.
Our network access control systems
can be tailored for specific requirements as well,
such as time-based, location-based, role-based,
or rule-based access controls.
This type of flexibility allows organizations
to create a more dynamic and robust security environment.
Time-based access control and NAC
is used to limit a device's network access
to specified hours based on the organization's
operational schedule.
This is particularly effective in environments
with predictable working hours,
like a business that operates daily from nine to five.
For example, if somebody's trying to log in
and access the network at 2:00 AM,
which is clearly a time outside of the regular 9:00 AM
to 5:00 PM business hours,
this access request will automatically be denied
in order to reduce the risk of unauthorized access
during this more vulnerable off-hours time period.
Now, if you're using time-based access controls,
I want you to remember that flexibility
has to be kept in place if you're operating
with a global diverse workforce
that has employees spread out across different time zones,
or if you have a lot of employees who travel a lot for work.
In these cases,
time-based controls should be configured to adapt
to various regional working hours,
so that secure and uninterrupted access
for legitimate users across the globe
is going to be maintained even while providing
additional off-hour restrictions
to increase your overall security.
Location-based access control is another one
we have to think about,
and these are used to enhance network security
by utilizing geolocation technologies
to verify the physical location of the device
that's requesting access to your network.
This method is particularly useful in preventing
unauthorized access from unexpected locations.
For example, if an employee is assigned to work normally
out of New York and they try to log in
from a distant location like London or Paris,
that system can be configured to flag this
as a potential security risk
or to simply block that access completely.
This approach is invaluable in identifying
any compromised credentials that may be used
from an unfamiliar location.
For example, if you're configuring a network
that's used by a local doctor's office,
it should probably be configured
so it only allows requests from within that city,
that state, or maybe even that country,
but anything else would be flagged or denied
if they're trying to access the network
from someplace like England or France
instead of from their local doctor's office,
which might be located in Florida, for example.
Now, if you're going to set up location-based access controls,
you have to make sure you consider
how legitimate remote access is going to be provided
to your users,
especially users like salespeople or consultants
who tend to travel and work remotely a lot of the time.
Now, role-based access control in NAC
is going to be another way that we can provide dynamic methods
of regulating access,
but this time it's based on the user's role
within the organization.
This role-based system is designed to grant permissions
according to the specific needs and responsibilities
associated with each job role.
For example, a network administrator may have broad access
to various network segments and resources,
while an employee working in the marketing department
may only need access to a few portions of the network
that are considered more pertinent
to their specific job functions.
This ensures that users have the necessary access
to perform their duties effectively
while minimizing the risk of unauthorized
or inappropriate access to the more sensitive areas
of the network.
Role-based access control is really powerful,
and it's a way for us to enforce
the principle of least privilege,
because our users are granted only the access they need
for their specific roles.
Rule-based access control, on the other hand,
is going to operate using a set of predefined rules
to methodically grant or deny access
by assessing logical conditions and statements
based on the specific user's identity and context.
This rule-based access control mechanism
can be as simple or as complex as you want,
with rules like:
Allow access to financial records only for users
in the finance department, which makes a lot of sense.
Or: Deny internet access for devices in the production area.
Both these are things you can configure
using rule-based access.
Another example of rule-based access control
is one in which the organization requires
that any device that connects to their network
has to have a certain type of antivirus installed on it
that has a certain level of security patches installed
and other things like that.
When rules like this are configured,
the devices can be scanned for compliance
when it first attempts to connect
to your organization's network
by using either a persistent or non-persistent agent.
By applying rules like these,
organizations can create a tailored access environment
that responds to various scenarios
and ensures that our network resources
are being used appropriately and securely by our users.
This approach is quite effective
in large and diverse organizations
where access needs will vary greatly
across different departments and user groups.
This allows for more nuanced control over who accesses what
and under what circumstances,
because we can create any rules
that we might need based on our organization's use case
and requirements.
So remember, network access control
is a method for increasing the security of a given network
by inspecting devices as they try to connect to the network
in order to determine if they're secure enough
to be granted access.
NAC, or network access control,
will allow us to control access
based on the device's health, user identity and compliance
with our organizational security policies.
NAC is not just about denying unauthorized access though,
it's about ensuring that every device
and every user that connects to your network
has been verified, is compliant, and is secure.
This proactive stance on network security
is really indispensable in an era where threats are
ever-evolving and rapidly increasing in sophistication too.