Experts advise caution on implementing NAC
623553
(InfoWorld) - Security researchers and experts this week cautioned network administrators to consider carefully whether they need to implement network access control (NAC) technology in their security infrastructure before buying in to the current hype surrounding it. Speaking on a panel at the Interop New York conference Josh Corman, host protection architect for Internet Security Systems, said that a company should have good reason to implement NAC, not just purchase the technology because it's the latest "buzzword" in the industry. "Do you want NAC because you heard itâs important or do you have real business problems to solve?" he said. NAC allows companies to perform health checks on end-point devices such as PCs and mobile devices before they are granted access to company networks. For example, employee PCs might be checked to make sure they are not infected with a virus and have up-to-date antivirus definitions before being allowed onto a corporate LAN. Corman was joined on the panel by Mike McKinnon, American director of security for Hewlett-Packard's ProCurve networking business; Elliott Glazer, direct of security architecture and consulting for Depository Trust and Clearing Organization; and Paul Stamp, a security analyst with Forrester Research. Speaking from a customer perspective, Glazer said he is more concerned at the moment with making sure the network infrastructure in his company itself is secure before worrying about how that network can check on the health of devices coming on to the network. "One of the fundamental things that has to be considered when you think about NAC is, is the network secure enough?" he said. "When I look at NAC, I say it's a great thing to do, but what do I do when someone comes in with a new piece of hardware -- what's it going to do to my network? Before I go down a NAC path, I'm going to make sure there is a secure environment there for me." "There's a lot of great stuff about NAC, but for us it's a little early," Glazer said. Forrester's Stamp said that for NAC to work effectively, companies involved in providing network security and those developing client technology must work together to make sure the networks can communicate effectively with endpoint devices. "[In NAC] it is the client-based technologies that are giving us the information, it is the client-based technologies that have to deal with any of the problems that arise," he said. "We as security are setting the policies, but the policies are taken into actionable rules by endpoint people. We have to be open to that and help them out. ... We really have to embrace the involvement of the endpoint guys."
727242
a potential problem that led a national group of emergency-room doctors Monday to call for better preparation for the oncoming
169202
(InfoWorld) - Cisco announced a pair of additions to its Network Admission Control (NAC) product line on Monday, launching new tools that promise to extend the authentication system to a greater variety of devices and office environments. The introductions were timed to coincide with the start of the Security Standard Conference in Chicago, which is owned and operated by InfoWorld's parent company, IDG. They come hot on the heels of Cisco's late-August announcement that Intel will arm computers using its vPro and Centrino microprocessors with the ability to communicate their security posture to corporate networks, even before they have been booted up. Â  Cisco unveiled its Network Module for NAC, which will give customers the ability to implant the authentication system into the vendor's Integrated Services Router (ISR) hardware, along with its NAC Profiler, which is meant to allow users to monitor a greater number of non-PC devices using the security tools. Executives with the San Jose, Calif.-based company said the latest products evidence the company's ongoing work to mature NAC aggressively. "This is an announcement where you see things continue to develop, not only in terms of the types of things that NAC technologies can do, as was the case with the chipset interaction, but also in terms of addressing problems that everyone has, such as getting posture assessments for devices that don't run on Windows," said Brendan O'Connell, senior product manager for Cisco's Security Technology Group. "With the ISR module, we're giving customers the option to push NAC into the branch-office setting, which is something else customers have been asking us for," O'Connell said. "It's all about increasing NAC's ease-of-use and operability." While Cisco is widely credited with inventing NAC technology -- which is identified by other vendors by the more generic term "network access control," and is used to verify a device's identity and security standing as it attempts to connect to a network -- some industry watchers have criticized the manufacturer for not moving faster to introduce products such as its new releases. In addition to expanding the potential footprint of its NAC systems by driving the technology into its ISR hardware, which it has been selling to customers for over three years, Profiler addresses one of the primary security concerns raised with the authentication systems, namely, their ability to identify and monitor IP-connected devices other than desktop and laptop computers. Based on NAC's complexity, some companies have chosen to use branch offices or remote locations to test its impact and efficacy in the field before blending the tools into their central IT networks, Cisco officials said -- exactly the type of scenario the ISR module will seek to facilitate. The ability to add NAC via a blade in the ISR devices will also appeal to small and medium-size businesses (SMBs), the networking giant contends, as will the ability to license the technology for office settings with 50 to 100 users -- the smallest deployment alternative for the tools the vendor has offered to date. Cisco maintains that by offering NAC monitoring for IP-connected machines such as Voice-over-Internet-Protocol (VoIP) phones and networked printers, companies will no longer be forced to formulate complicated exceptions to test the devices. In adding direct hooks for such equipment into NAC, Cisco claims it has also addressed the perceived security loophole created by the need to create such exemptions, which some have said made it easier for attackers to defeat the authentication systems by spoofing such devices. "It's not just PCs that are connecting to the perimeter of a network where customers need to make these types of decisions, which has been sort of a hole for a while as it was cumbersome to do NAC securely for some of these other devices, and users didn't have much information at their fingertips when they could do it," O'Connell said. "In some customer deployments, over half of the devices on the network are IP phones today, so, Profiler is an important step forward in improving NAC's abilities to that end." Ladi Adefala, security practice manager for World Wide Technology, a St. Louis-based systems integrator that both uses and re-sells Cisco's NAC products, said the new products should help expand the technology's uptake in both larger and smaller customers. Many companies have been looking for ways to test NAC in smaller settings and then extend the tools to a wider set of users, making the Network Module product launch particularly important, he said. The Profiler will eliminate the need for IT shops and service providers like World Wide Technology to port NAC to phones and other devices, a time-consuming process, according to Adefala. Cisco has been actively marketing two approaches to NAC -- using its appliances to provide local protection on networks and also utilizing its top-down network-wide "framework" strategy. This has caused some customers to spend a long time deciding which route to go down, the expert say. However, Adefala contends that more companies are jumping further into NAC as Cisco's products become more mature. "There was some initial confusion with which way to go, but Cisco has been able to get most customers to begin considering it more closely, particularly by marketing the appliance as a one-stop shop for NAC," he said. "I think that will continue to be the case over the next year because of the type of announcements we're seeing here, and more integration with third-party products." One industry analyst echoed those comments, saying Cisco's is making "incremental improvements" with each NAC product release and likely growing its overall customer base for the tools. Cisco's move to launch the NAC Profiler directly addresses a "perceived shortcoming" of the systems in allowing more devices to be tested, while the Network Module will encourage broader deployment among large multinationals and among smaller firms, said Phil Hochmuth, analyst with Boston-based Yankee Group. "They're trying to fit in more places with both the switches and the framework. Obviously a lot more customers are using the [appliances] today because they are easier to deploy, but I think the framework will eventually appeal to some people," Hochmuth said. "They also have all these switches in place, and if they can harness that to sell NAC, that could be pretty powerful. "NAC remains complicated and Cisco has been guilty of playing both sides a bit with the two different approaches, but they know that if they can get customers to adopt it today with the appliances, the eventually might go for the network-wide approach," the analyst said.
696054
WASHINGTON -- Federal health officials asked experts Thursday whether the drug-coated stents used to prop open the arteries of about 3 million people in the U.S. pose a heightened risk of death or raise other safety concerns that require action.
294488
Experts will rate potential severity of business security threats.
228986
Speaker asks: "Do you want NAC because you heard it's important or do you have real business problems to solve?"
303627
(Source: ForeScout) Are you confused about Network Access Control? You are not alone. Today's enterprises are facing a growing challenge in securing access to their networks as the number of corporate mobile users and contractors increase. Adding to this challenge is the difficulty of integrating network security solutions into existing complex and diverse enterprise network infrastructures. Download this white paper and find out how to implement a flexible, comprehensive NAC solution for your company.
259000
The groundbreaking action by the Federal Trade Commission against two New Hampshire software companies is &quot;long overdue,&quot; said one local computer expert.
161820
Don&#39;t be embarrassed to question your doctor about that new prescription he&#39;s written, the National Council on Patient Information and Education advises.
85369
Experts say the move could lead to suits against the U.S. or private companies.
442622
It's not exactly light reading, but there's plenty of good news in a report from the National Academy of Engineering. It's a list of the "Grand Challenges" in engineering this century compiled by an array of experts like the genetics researcher J. Craig Ventner and Google's Larry Page. What's encouraging isn't so much the list [...].
755292
An adverse panel recommendation could threaten Northgate Minerals' golden opportunity.
170403
As Congress eyes a boost to fuel-economy standards, auto industry hints that safety could be compromised. Some experts disagree.
612705
A panel of leading computer scientists warned in a report issued last week that unless the US federal government significantly increased support for advanced research on supercomputing, the US would be unable to retain its lead on that technological front
566018
As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy.
475827
A new report released by an American Physical Society (APS) Special Committee on NASA Funding for Astrophysics has questioned the space agency's Moon, Mars and Beyond initiative. The APS assessment warns that t  he cost of overcoming technological challenges to make real the plan could far exceed budgetary projections and that numerous&nbsp;approved science programs could be jeopardized.
414880
A long-awaited audit of cervical cancer services has reiterated the advice experts have been giving for years, that there needs to be a national cervical screening data base.