Aha! Now I see said the blind man

I couldn't help but laugh reading Tim Greene's NAC newsletter today. Tim is taking about a NAC customer who uses NAC without the enforcement or "self-remediation" turned on and has done so for over a year.  Tim reports that the customer is still finding tremendous value in his NAC product by being able to understand who is logging on the network, what port they are plugged into and what their endpoints look like. 

Though the customer referenced in Tim's article is not a StillSecure customer, it really doesn't matter.  What Tim is describing is exactly what we have been preaching on NAC for 2 years now.  NAC is not all about the quarantine!  Too many people focus in on NACs ability to shut people off the network, but that is not end game people.  Here at StillSecure we have one large network that tests over 200k devices a day and quarantines almost no one!

Most people accessing the network have a legitimate right to be on the network.  Our job is to make sure they do so in compliance with our security policies so they do no harm and are not harmed.  We actually wrote a great white paper on this very subject called "A phased approach to NAC" that describes how to roll out NAC in phases and the value that can be derived from each phase.  You don't have to get all the way to the enforcement or quarantine phase.  Many customers are content with the value they derive without quarantine to more than justify the investment in a NAC system. 

I think part of the maturation of the NAC market is the realization of this value. I hope that Tim's newsletter will help spread the word that NAC is not just about the quarantine!

One caveat though is that some customers are just not happy unless they can eventually quarantine devices.  For those customers your NAC solution has to have the ability to do this irrespective of your network architecture.

Related articles by Zemanta

• Infonetics proclaim NAC alive and kicking
• Vulnerability scanning NAC - Thats why it is the wrong tool at the wrong time