In Hollywood, the killer mutant virus always kicks mankind's butt. For security pros, this is one area where life too often imitates art--a single infected laptop can make for a very long night. While the Storm worm made headlines, its main propagation method is through user action. That's defensible. It's automated worms such as SQL Slammer and Code Red that are likely to do far more damage when they get into your network, because they can infect any vulnerable computer without end user intervention.

Welcome to the final chapter in our ongoing series of NAC Rolling Reviews. We've covered in-band and out-of-band network access control systems, and now we turn to host-based NAC, which aims to solve problems such as malware propagation and unauthorized access by adding agents to hosts and controlling access from the source of the problem, rather than in the network or at a perimeter.

We've invited 11 vendors to show us their stuff. Most tout simple-to-install agents that augment or replace existing security tools. What's more, there are no network changes involved. No recabling. Fewer choke points and single points of failure. No creating virtual LANs, subnets, DHCP scopes, or 802.1X. That benefit alone will make host-based NAC palatable to companies that just don't want to mess with their network topologies.

Our most recent NAC trend survey showed host-based NAC on par with out-of-band, both at 48%, when we asked what changes readers would be willing to make to their networks. In-band is still the NAC architecture of choice, at 56%. We also asked about types of activity that require access control. The top three answers: access to the data center (49%), remote access (39%), and branch office access to company resources (37%). This shows that our readers want internal access control and that they have operational power over endpoints--a critical requirement for host-based NAC. Companies for which controlling guest access is crucial should look to another strategy, because installing a permanent agent on an unmanaged node is an iffy proposition at best.

WATCH OUT FOR THAT WORM
NAC vendors across the board say worm containment is a top driver. The idea is that assessment during and after network connection will pinpoint infected nodes. The NAC system can then take action, moving the host to a quarantine network or forcing upgrades and cleaning before it's allowed back on the network. The big "if" here is properly detecting infections in the first place--not an easy task because more-invasive malware disables antivirus and other security software.

Still, if your goal with network access control is to restrict user activity, what better place to apply policy than on the host itself? Many host-based NAC software suites combine anti-malware, desktop firewall, and application access control, at a minimum, to protect hosts from malicious software ... and from the person at the keyboard. We know that antivirus software can identify only that malware for which it has signatures, meaning new viruses are often undetected. In contrast, desktop firewall software not only blocks network traffic attempting to access the host, it can also limit how host applications can access the network. Application access control is not new--it's been in desktop firewall software for years--but the relevance to NAC is evident: If an application is unable to send e-mail or connect to IRC, or make any network connection, for that matter, its adverse impact is mitigated. The malware must still be removed, but you've bought yourself time.

Considering that many network access control products allow access to the network to do assessments anyway, a host-based NAC product squelches problems at the source.

One sticking point: IT often shies away from agent technology. Yet nearly all NAC products use some form of agent for host assessment and login tracking. So-called "dissolvable agents" are ActiveX or Java components that must be downloaded and executed on the user's computer, often with Power User or local Administrator rights. Moreover, unlike network-based NAC products that sit in line or out of band, the protective measures inherent in host-based systems travel with the computer, so a laptop is equally protected from attack at the coffee shop down the street as it is on the corporate LAN.

(click image for larger view)