Larry Edie & Annie Ballew

 Who are you users?  What do you know about your users?  How can you cost-effectively manage this information?  How can you use this information to enforce policy?

 User Based Identity ◦ Active Directory ◦ LDAP ◦ Tokens  Machine Based Identity ◦ Certificates ◦ Machine accounts  Identity based technologies ◦ 802.1x ◦ Remote Access VPN What else?

4 THE GOAL NAC Server gathers and assesses user/device information  Username and password  Device configuration and vulnerabilities Noncompliant device or incorrect login  Access denied  Placed to quarantine for remediation Device is compliant  Placed on “certified devices list”  Network access granted NAC Server NAC Manager End user attempts to access network  Initial access is blocked  Single-sign-on or web login Authentication Server 123a3b Quarantine Role Intranet / Network

 Regulatory Compliance ◦ PCI ◦ FISMA  Reducing Risk  Forensic Analysis

 Why would we need NAC? ◦ You know who your users are, but do you know what they are carrying into your network?  What are the implications of NAC? ◦ What are the maintenance implications? ◦ How does this affect business productivity?  Deployment Considerations ◦ What solutions are available? ◦ Is it a worthwhile investment?

 Role Based Access Control  Future of NAC  What does Identity mean for future technical paradigms, such as IaaS, SaaS, and PaaS?