The Need for Network Access Protection

Protecting the network is the number one challenge of most organizations today. What makes this difficult for many organizations is that many different kinds of users need to access their networks, including full-time employees who work on desktop computers, mobile sales professionals who need to VPN into corpnet using their laptops, teleworkers who use their desktop computers to work from home, consultants and other “guests” who come on site and need to connect their laptops to either LAN drops or wireless access points, business partners who need access via the extranet, and so on. Many of these computers need to be domain-joined, but others are not and therefore don’t have Group Policy applied when users log on. And not all of these computers are running the latest version of Microsoft Windows-in fact, some of them might not be running Windows at all!

Some of these computers will have a personal firewall enabled and configured, which might be either the Windows Firewall or some third-party product. Others might have no firewall at all on them. Most will have antivirus software installed on them, but some of these might not have downloaded the latest AV signature files from their vendor. Client computers that are permanently connected to corpnet will likely have the latest service packs, hotfixes, and security patches installed, but guest computers and machines that are not domain-joined might be lacking some patches.

The overall effect of all this is that today’s enterprise network is a dangerous place to live. If you are a network administrator and a machine wants to connect to your network, either via a LAN drop or access point or RAS or VPN connection, how do you know it’s safe to let it do so? What if you allow an “unhealthy” machine-one missing the latest security updates or with its firewall turned off or with an outdated AV signature file-to connect to your network? You might be jeopardizing your network’s integrity. How can you prevent this from happening? How can you make sure only machines that are “healthy” are allowed to access your network? And what happens when an unhealthy machine does try to connect? Should you bump him off immediately, or is it possible to “quarantine” the machine and help it become healthy enough so that it can be allowed in?