1. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #1 Tightening the Network: Network Access Control Deployment and Applications Paul Sangster Co-Chair TNC Working Group Distinguished Engineer Symantec Corporation

2. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #2 Agenda Problem Space Network Access Control Trusted Network Connect –Architecture –Participants –Usage example –Integration with security hardware

3. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #3 Malware Infecting Network Malware includes: viruses, worms, spyware, adware, … Detection and prevention difficult –Good security protections available (AV, firewalls…) –Malware constantly evolving, so must security protection –Challenging to keep up to date –Many security protections not in use Spread of Malware serious cost –IT costs, reputation, downtime, lost productivity… Many network entry points for Malware –Carried on mobile devices –Embedded in other objects

4. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #4 Identity-based Network Access Today, access to network restricted by Identity Identity established via re-usable credentials (password) Malware on system can steal credentials No check for system integrity before access –Use of malware protection, firewalls, proper patches –Presence of malware  Result: Even authorized people introduce malware to network

5. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #5 Need Automated Checking Automated Integrity Compliance Checks –Before being given access to the network –While present on network –Remediation support for non-compliant Multi-vendor ecosystem Centralized management Integrated with existing Identity-based controls –Allow certain individuals/roles more flexibility  Role of Network Access Control (NAC)

6. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #6 General Model NAC Software on Endpoint Device –Collects integrity information about state of system Includes: vendor, version, patch level, configuration, … –Reports on requested state of system –Optionally leverage security hardware (TPM) Central Compliance Decision Point –Requests integrity information (policy driven) –Compares integrity information to compliance policy –Decides on network access level Notifies network infrastructure of level of access granted –May request remediation

7. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #7 Trusted Network Connect (TNC) Working group within Trusted Computing Group (TCG) –Creating open, multi-vendor NAC standards Open NAC Architecture –Documented API and protocol interfaces Open NAC Standards –Free download from TCG web site

8. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #8 Basic TNC Architecture

9. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #9 TNC Standards Key: APIs, Network Protocols, Future

10. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #10 Example TNC Policy Endpoint MUST have … –Up to date OS and application patches –IT-defined password policy settings –Anti-virus enabled and up to date If not, –Quarantine and remediate Except guests, –Who just get Internet access Policy applied from central PDPs

11. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #11 Example Flows Patch Level IMC Patch Level IMV NARPEPNAA TNCCTNCS Anti-Virus IMC Anti-Virus IMV Password Policy Settings Patch Level AntiVirus Version Definition File Date QUARANTINE REMEDIATION Antivirus Version Definition File Date

12. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #12 TNC Ecosystem – August 2006

13. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #13 Protecting the TNC Client How can the PDP be sure the TNC client is accurately reporting its state? TNC client needs protection from malware –Malware could trick the client into reporting incorrect information –Malware could act as a measurement collector (IMC)  Answer: base security on hardware-rooted security mechanisms isolated from malware

14. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #14 TPM as Root for TNC Security Trusted Platform Module (TPM) –Hardware security module found on 10M+ systems –Includes cryptography engines (RSA, SHA-1) and key storage –Non-resettable registers Store aggregated fingerprints of SW/Configs –Create digital signature of register contents as basis for a report Platform Trust Service (PTS) –TCG specified software capable of creating Integrity Report –Integrity Report can include: Signed manifest of software running on system TPM signed set of registers corresponding to manifest details TNC Client can leverage PTS to report on its integrity and other software running on system

15. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #15 For More Information TCG Web Site https://www.trustedcomputinggroup.org TNC Web Site https://www.trustedcomputinggroup.org/groups/network

16. Copyright© 2005-2006 Trusted Computing Group - Other names and brands are properties of their respective owners. Slide #16 Questions?