If you read my blog, or know me, you probably know I do NOT like software (and it usually doesn’t like me). So, I’d be the first to jump on the ‘anti-software-peer-based-NAC’ train, but I think we have to be informed before we jump to conclusions and hop on any trains.

Mirage’s recent blog post on Symantec’s ‘Silly SNAC’ was certainly a result of a mis- (or un-) informed person. Tim did a much better job on his mention of SNAC in the NWW blog, but all the dots still aren’t connected. It proves the point that sometimes we (as bloggers) tend to write based on a feeling and sometimes don’t dig for the fact.

So, in an effort to make sure I understood this new peer-based NAC, I reached out to Patrick Wheeler, Symantec’s Senior Product Manager for Network and Endpoint Security. Based on my conversations with him, and a pretty detailed investigation into the options and configurations of their NAC products, I have some slightly more informed opinion to share with you now.

Symantec has a variety of NAC enforcement components and options. I’m going to keep all the software-type-stuff out of this conversation for the time being. They have (among other things) the NAC Enforcer, an appliance similar to the other NAC controllers we see from traditional hardware vendors. Just like it’s counterparts, Symantec’s NAC Enforcer can be configured for DHCP, inline or 802.1X based enforcement.

The piece that’s different is the integration of the NAC Enforcer with Symantec’s Endpoint Protection Manager server that hosts the policies for the NAC. It’s similar to the management-enforcement configuration we see from other vendors, only the management piece is housed on a server instead of another appliance.

And, just as other vendors offer some type of endpoint integrity agent, the Symantec agent comes in the form of the Symantec NAC Client, which can be used by itself, or integrated with the Symantec Endpoint Protection Client for an even more robust feature-set. (The Endpoint Protection Client offers some additional host-based firewall features that the NAC can leverage).

So, what about the Peer-Based NAC? Ah, well that’s just the first iteration of a ‘vision’ to address mobile corporate users. If employees have laptops in an ad-hoc situation outside of the enterprise infrastructure (and therefore, outside of enterprise enforcement), then the peer-based NAC can port the enforcement rules set at the ‘mothership’ and enforce them individually. The peer-based NAC can protect mobile assets in their most vulnerable situation, outside the security of the corporate network. But, the rules are still set centrally and the peer-based NAC was designed to be just one step towards an added layer of protection, not as a replacement for network-based NAC.

For now, I’ll stay off the hate train, since the peer-based NAC is more of a supplement to a more robust traditional NAC solution. If they move to a fully-host-enforced product, I’ll buy my tickets…

Image shown is copyright of Symantec Corporation.

# # #

This webcast summary of the Internet Security Threat Report will:
Provide a six month update of worldwide Internet threat activity, including analysis of network-based attacks, a review of known vulnerabilities, and highlights of malicious code
Assess trends in phishing and spam activity
Alert attendees to current trends and impending threats
Offer recommendations for protection against and mitigation of these concerns.

Attend this webcast to learn what stealth tactics attackers are using to prey on end users, how these trends are determined and why these devices should be of concern to your organization.

This webcast summary will provide you with insight from Symantecs Global Intelligence Network which has some of the most comprehensive sources of Internet threat data in the world. It includes more than 40,000 sensors monitoring networks in more than 180 countries, malicious code reports from more than 120 million client, server, and gateway systems and one of the world's most comprehensive vulnerability databases, consisting of more than 25,000 recorded vulnerabilities affecting more than 55,000 technologies from more than 8,000 vendors.

Leverage this vast wealth of data and learn how to protect your organization from the latest internet threats. Register today.

Airing on Friday, May 2nd, at 10 am PDT/1 pm EDT.

Good article by Neil Roiter from Information Security Magazine on NAC moving ahead as the hype subsides. For a change from other articles we have read recently, Neil gives a true to life, no holds barred assessment of where NAC is in the market.  I think some of the comments from Lawrence Orans over at Gartner are right on.  However, one he misses is in talking about the Cisco-Microsoft NAC partnership. I think the TCG-Microsoft partnership has replaced that one and Cisco is going to join that party through the NEA. 

For me though the quote of the article was this one by Brendan O'Connell, Cisco's product line manager for NAC, "NAC is an Easter egg hunt. Policy lives in a lot of different places .."  So does that make Cisco the NAC Easter Bunny? Seriously, policy does live in a lot of different places.  I think eventually the answer lies in marrying network based admission control policies with endpoint based configuration policies.  This is an area that is ripe for interaction and integration.  I also think that Symantec talking about customers want a NAC solution, but not another console or another agent was a bit ironic.  Just because you lump your agents together doesn't mean you have not added yet more overhead to the equation.  Anyone who has used Symantecs new Endpoint Security with all of the mods turned on can talk to you about overhead and resource use. Whether the agent is separate or not, it is what the overhead is that counts.

In any event, though Neil did not mention StillSecure (tsk, tsk) I thought this article was right on, that despite the naysayers and the inflated hype, NAC is being adopted in the market. It is maturing and most of all it is providing value to customers.

Good article by Neil Roiter from Information Security Magazine on NAC moving ahead as the hype subsides. For a change from other articles we have read recently, Neil gives a true to life, no holds barred assessment of where NAC is in the market.  I think some of the comments from Lawrence Orans over at Gartner are right on.  However, one he misses is in talking about the Cisco-Microsoft NAC partnership. I think the TCG-Microsoft partnership has replaced that one and Cisco is going to join that party through the NEA. 

For me though the quote of the article was this one by Brendan O'Connell, Cisco's product line manager for NAC, "NAC is an Easter egg hunt. Policy lives in a lot of different places .."  So does that make Cisco the NAC Easter Bunny? Seriously, policy does live in a lot of different places.  I think eventually the answer lies in marrying network based admission control policies with endpoint based configuration policies.  This is an area that is ripe for interaction and integration.  I also think that Symantec talking about customers want a NAC solution, but not another console or another agent was a bit ironic.  Just because you lump your agents together doesn't mean you have not added yet more overhead to the equation.  Anyone who has used Symantecs new Endpoint Security with all of the mods turned on can talk to you about overhead and resource use. Whether the agent is separate or not, it is what the overhead is that counts.

In any event, though Neil did not mention StillSecure (tsk, tsk) I thought this article was right on, that despite the naysayers and the inflated hype, NAC is being adopted in the market. It is maturing and most of all it is providing value to customers.