-: Network access control.
So, what is network access control?
Well, it's the device that's gonna limit your network access
only to authorized individuals and systems.
Now, the great thing about network access control
is that it doesn't just use usernames and passwords
but it can actually have contacts and further scans
to ensure proper access before they
allow something on the network.
This is gonna ensure that the systems connecting
to the network meet basic security requirements.
So, for example, I've seen network access control systems
that when you connect to the wifi it puts you into
an isolated network, scans your computer for viruses
and that you have the latest version of Windows whatever
and then, allows you to connect to the internet.
It always makes sure that you are good before it does it
and that's the idea here, with NAC.
Now, there's a couple of ways you're doing that.
One of them is 802.1x and 802.1x is the protocol
that is most commonly used for network access control.
The way it works is the same for wired to wireless networks
and essentially, you have a supplicant and authenticator
and a RADIUS server.
The supplicant or your work station,
whether it's a laptop, desktop or handheld device
is gonna connect to the switch, which is the authenticator.
The authenticator is gonna pass that over to
an authentication server or RADIUS server.
RADIUS is gonna check your username and password
or your token or your credentials or your key
and then, it's gonna send it back to the authenticator
which then passes that over to the supplicant
and once it has that, that makes a connection
between the authenticator and the supplicant
and data connections can occur,
And at that point, the machine is connected to the network
and off it goes because it's
passed it's network authentication.
That's the way 802.1x works in a nutshell,
in about 30 seconds.
Now, when we start talking about agent based
and agentless NAC, there's two different things here.
Agent based is just like you'd think.
There's a device on your network.
It's gonna request the device, has access to
this special software on it that communicates
with the NAC service, something like 802.1x.
You have something installed, you install the key
or password and this piece of software, this agent
is gonna do the handshaking for you.
Now, when you talk about agentless, this is more
like when you go on traveling, you go to a hotel
or if you go to Starbucks, or Panera Bread
and you connect to their wifi.
What happens is, there's network authentication
that happens there as well.
It's still in NAC authentication.
What happens here, is it happens inside your web browser
though, and you don't need special software
because when you connect to Panera Bread, for instance,
it connects you and it puts you into an isolated environment
and it shows you a webpage where you have
to accept their terms and conditions.
Once you do that, they move you on to the general network
and allow you to go to the internet.
That's an agentless authentication
and it's very common in wireless networks in hotels
or coffee shops and other places like that.
Now, the other thing you can look at with NAC
is in-band and out-of-band.
Now, what does that mean?
Well, in-band is gonna use a dedicated appliance
that places the device in the services their requesting
on the same network.
So, when you're on a hotel network
and they require you to enter your room number
and name before you gain access,
that's an in-band authentication.
You connect to the network, you give it your username,
you give it your password and then,
it let's you go on further.
Out-of-band, on the other hand,
relies on an existing network
and has a device communicate to this authentication server.
This is something like 802.1x.
It doesn't connect on the same network
to do the authentication, it's an out-of-band connection.
It's off the network connection.
So, either of these could be used.
Now, honestly, I'll tell you for the CSA plus exam,
you're probably not gonna get a lot of in-band,
out-of-band questions.
I just haven't seen a lot of questions on those
when I start looking and studying for the CSA plus.
But it is a good concept when you're designing
a network to figure out which way you want to go.
As far as the CSA plus exam is gonna go,
they're not gonna ask you about NAC in general,
but they're not gonna get into that much detail on it.
Now, when you talk about NAC approval,
how does NAC actually approve whether or not
you're gonna get access on the network?
Well, one of the ways can be time of day.
If it's 3 o'clock in the morning,
maybe the hotel is not gonna allow you to have wifi.
Whatever, if you're at a school, for instance,
they won't allow wifi at three in the morning.
The role of the user.
Admins can access the datacenter,
only when they're inside the datacenter.
They can't do it from their desk in the intranet.
That can be something you can do for NAC.
You're location, right?
If you're in the data center you can access it.
If you're outside the data center you can't.
I've also seen NAC approvals based on geography.
So, if you're sitting in the UK in Britain,
you can access the server, but if you're in America,
you can't because it's a British server
and it will geographically lock you,
based on the IP you're coming from.
Netflix is really good at this, right?
If you try to go to Netflix, when you're on vacation
overseas, if you're a US based customer,
it won't let you connect, because it will go,
"Oh, you're outside the US, you have a US plan.
"You're not allowed to connect to Netflix, right now."
so, a lot of people will connect through a VPN
or something like that, to trick the location
and then the other thing is system health status.
I talked about this earlier.
When you connect, it's gonna make sure your anti-virus
is up to date, it's gonna make sure your security patches
are installed, it's gonna make sure you have a firewall
enabled on your host, all those things that are good
security practices, to make sure you're not bringing
a dirty infected laptop into our corporate network
and infecting the rest of us, right?
And so, we'll put you in this isolated network,
verify you're clean and then, bring you in
based on NAC criteria, as shown here
and that's the idea with network access control.
Again, you need to understand what it is.
You should know the different types of things
you can connect based on, that
last slide we just talked about,
but don't worry too much about in-bound, out-of-bound
as far as the exam goes, because CSA plus
is not gonna dig deep on that
but if you're doing this as a security analyst
in the real world,
you need to understand these concepts
so you can make suggestions on how to design
these secure networks, using things like
network access control.