Enterasys uses NAC to protect VoIP

Security: Network Access Control This newsletter is sponsored by Nevis Networks Webcast: Cut Through NAC Hype Over the past few years, network access control has evolved to encompass a large number of endpoint security compliance, malware detection, access control and authentication products with very different focuses. Cut through the hype and confusion to find real-world NAC answers. Network World's Security: Network Access Control Newsletter, 08/23/07 Enterasys uses NAC to protect VoIP By Tim Greene Enterasys has wheeled out a bundle of its technology, called Secure Open Convergence, to protect VoIP networks - and that protection includes NAC. VoIP is a difficult area for NAC because NAC relies on endpoint assessment as a key factor in deciding whether a device gains admission to a network. VoIP phones are typically proprietary and don’t support client software that can scan and report in on their security posture. Since thorough NAC endpoint checking that employs client software is out of the question, the next option is using MAC authentication - authenticating a machine based on its MAC address. This can be combined with identifying the operating system of the phone, the switch port being used and other externally discernable factors to create a NAC policy for phones. Network World Security Buyer's Guide Find the right security products for your enterprise - fast. From anti-spam to wireless LAN security, our Buyer's Guides have detailed information on hundreds of products in more than 20 categories. With the side-by-side comparison tool you can evaluate product features to make the best decision for your enterprise. Click here to go to the Security Buyer's Guide now. The assessment may give some assurance that the device logging in as a phone is actually a phone, but it leaves open the possibility that he device is something else spoofing a phone. It tells nothing at all about whether the device is infected. The only way to protect against a device masquerading as a phone or an infected phone executing a malicious exploit is to monitor the behavior of these devices once they are on a network. The NAC protection needs to have post-admission policies that state what resources an IP phone is allowed to connect with. For example, a device identifying itself as a phone and trying to connect to a human resources server is probably not a phone. A post-admission NAC policy ought to cut that device off the network. This is valuable protection for a VoIP network and Enterasys is right to include its NAC gear as part of its VoIP-protection initiative.   What do you think? Post a comment on this newsletter

TODAY'S MOST-READ STORIES: 1. Gunplay blamed for Internet slowdown 2. 1.6M records stolen from Monster.com 3. 10 virtualization companies to watch 4. Business e-mail overtakes the telephone 5. Skype users don't buy outage explanation 6. Google struggles with phone number 'for life' 7. Skype: Network felled by Windows Update 8. Voyager spacecraft celebrates 30-years 9. Top 10 'networkiest' eBay oddities 10. Is onshoring become the new offshoring? MOST-READ REVIEW: WAN acceleration offers huge payoff

Contact the author: Tim Greene is a senior editor at Network World, covering network access control, virtual private networking gear, remote access, WAN acceleration and aspects of VoIP technology. You can reach him at tgreene@nww.com. This newsletter is sponsored by Nevis Networks Webcast: Cut Through NAC Hype Over the past few years, network access control has evolved to encompass a large number of endpoint security compliance, malware detection, access control and authentication products with very different focuses. Cut through the hype and confusion to find real-world NAC answers. ARCHIVE Archive of the Security: Network Access Control Newsletter. BONUS FEATURE IT PRODUCT RESEARCH AT YOUR FINGERTIPS Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details. PRINT SUBSCRIPTIONS AVAILABLE You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today. International subscribers, click here. SUBSCRIPTION SERVICES To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription. Advertising information: Write to Associate Publisher Online Susan Cardoza Network World, Inc., 118 Turnpike Road, Southborough, MA 01772 Copyright Network World, Inc., 2007