Automated Network Access Control (NAC) at the Edge. Communication Technologies-Networking Jim Gogan Mike Hawkins Ryan Turner October 30, 2008

Transcription

1 Automated Network Access Control (NAC) at the Edge Communication Technologies-Networking Jim Gogan Mike Hawkins Ryan Turner October 30, 2008

2 NAC: What is it at UNC? Technology to manage voice, video and data end points Location and identification Controlled Access Determination of end point health status Is it? Security? Management? Both! its.unc.edu 2

3 NAC: In the marketplace? Discovery/Detection Authentication Assessment Authorization Remediation - pre and post connect What fits your organization? its.unc.edu 3

4 Security in an open access culture Many different types of devices/users Devices (many) that do not login New applications, devices all the time Differing populations of users No control of end points Requirement to avoid impacting users Challenges in a Large University Network its.unc.edu 4

5 Why NAC for UNC? Stop/limit the impact of problem devices Self-protecting Provision devices/users to do their work Affect change of state of device/user as quickly as possible Manage efficiently Secure network devices Saves time: users, staff its.unc.edu 5

6 NAC: When? Pre-connect AND Post-connect Manual and automated Input from Security devices, software: STANDARDS! Input from other programmable sources as needed: STANDARDS! WHEN? Proactively when needed its.unc.edu 6

7 NAC: How? Intelligent infrastructure Standards - best of breed products TCG/TNC groups RFC X Extensibility of solution set Programmable-use as foundation for other tools Customize for your environment Cut features off you do not use Standards based to work in other solutions and products its.unc.edu 7

8 NAC: How? Authentication mechanisms: at UNC - hardware address (MAC) based is primary Policies on switches: static and dynamic At the edge or near the edge: internal advantages Link other technologies with NAC its.unc.edu 8

9 NAC: How? UNC Specifics Software Netsight NMS Policy Manager Automated Security Manager NAC Manager Other components Use what you need Hardware: Policy enabled switches enabling edge authentication Hardware: NAC Gateways NAC Gateway its.unc.edu 9

10 NAC: How? UNC Specifics Hardware: Intrusion Detection, Prevention Tipping Point Manual Processes that feed in: SNORT Nessus, tests of other scanning software Copyright notifications user/device removed Other problems: duplicate IP, buggy product, etc Automated Processes: Web pages for Security group & Custom captive portals for user interaction Smartbox tool User location tool for tech support Captive web re-direct for notification, remediation its.unc.edu 10

11 NAC: More parts at UNC Policies on switch - Acceptable Use Policy (AUP) Policies on switch dynamic change Primary authentication: MAC based Blacklisting drops user/device everywhere Priority access: ex. provisioning for VOIP State changes: manual, semi-automated, automated Web redirect: keep user informed saves support time its.unc.edu 11

12 NAC: The next steps Move to 802.1X More web re-directs for more conditions Scanning of more sensitive users, devices Further web page automation: Vlan changes for some widespread systems Helping system administrators find devices Tiered authentication structure its.unc.edu 12

13 its.unc.edu NAC at UNC: The Pictures

14 Intelligent Infrastructure: Post-Connect NAC Threat on the network after connection NetSight Suite: NAC Manager NAC Gateway (out-of-band appliance) NAC Functions 1. Monitor 2. Contain - even after move! 3. Notify or Remediate 1 Role = Quarantine IDS, NBAD, SEM, etc (in or out of band) 3rd Party Switch Wireless VLAN = Quarantine its.unc.edu Thanks to Enterasys Networks for help with content of this poster/slide. 14

15 Intelligent Edge: Pre-Connect NAC Non-compliant asset attempting connection to the network Netsight Suite: NAC Manager 5 NAC Functions 1 Detect 2 Authenticate 3 Assess 4 Authorize 5 Notify or Remediate Role = Quarantine 1 NAC Gateway (out-of-band appliance) 4 User Laptop Enterasys Matrix/SecureStack Switch Compliance Check 3 2 Authentication Server its.unc.edu Thanks to Enterasys Networks for help with content of this poster/slide. 15

16 Thanks Communication Technologies-Networking Jim Gogan Mike Hawkins Ryan Turner October 30, 2008