1. Larry Edie & Annie Ballew

2.  Who are you users?  What do you know about your users?  How can you cost-effectively manage this information?  How can you use this information to enforce policy?

3.  User Based Identity ◦ Active Directory ◦ LDAP ◦ Tokens  Machine Based Identity ◦ Certificates ◦ Machine accounts  Identity based technologies ◦ 802.1x ◦ Remote Access VPN What else?

4. 4 THE GOAL NAC Server gathers and assesses user/device information  Username and password  Device configuration and vulnerabilities Noncompliant device or incorrect login  Access denied  Placed to quarantine for remediation Device is compliant  Placed on “certified devices list”  Network access granted NAC Server NAC Manager End user attempts to access network  Initial access is blocked  Single-sign-on or web login Authentication Server 123a3b Quarantine Role Intranet / Network

5.  Regulatory Compliance ◦ PCI ◦ FISMA  Reducing Risk  Forensic Analysis

6.  Why would we need NAC? ◦ You know who your users are, but do you know what they are carrying into your network?  What are the implications of NAC? ◦ What are the maintenance implications? ◦ How does this affect business productivity?  Deployment Considerations ◦ What solutions are available? ◦ Is it a worthwhile investment?

7.  Role Based Access Control  Future of NAC  What does Identity mean for future technical paradigms, such as IaaS, SaaS, and PaaS?