McAfee tries to take NAC back to the stone age

I have been reading about it in bits and pieces for about a week now, but reading Tim Greene's column this morning confirmed it for me. McAfee the company that usually buys whatever innovation it needs, tried to build their own NAC system and in doing so is trying to take us back to the stone age of NAC. I guess we should not be surprised that a dinosaur of a company would have us perform NAC with caveman tools.

Lets be clear, McAfee has offered NAC for a while now. It was called MNAC and was part of the uber-suite.  Everyone agreed it was pretty weak and not much of a NAC product.  It really had no provision for guest or unmanaged devices.  Other than the agent acting as a reverse firewall it depended entirely on either Cisco NAC framework or Microsoft NAP to perform network enforcement.  The need for guest or unmanaged device control and network based enforcement was painfully obvious. 

So taking a page from the GEICO caveman. McAfee is seeking to move NAC back to the stone age. They took their expensive Intruvert derived, "purpose built" IPS and re-purposed it for NAC.  So now McAfee has a network based NAC product.  Sure, you just have to buy a few or a dozen expensive "purpose built" IPS boxes that now have I guess, a "purpose built" NAC on there as well and place them all over your network. Now they can block unmanaged devices and provide network based NAC enforcement even if you are not one of the two people who use the Cisco NAC framework or you don't yet have Microsoft NAP.

This is a page out of Juniper UAC v1 back in 2005 or so.  It didn't scale then and it doesn't scale now.  At best this is a finger in the dike strategy until McAfee realizes that they have to do it the McAfee way. They just can't build innovation and they have to go out and buy a NAC company.  In the meantime, I don't expect anyone but the most diehard McAfee customers will find much merit in this retro approach to NAC!