As the holidays near, our annual shutdown period is commencing and it’s a time for us to power down facilities to reduce our carbon footprint. It’s also a great time to reflect on what we’ve accomplished throughout the year. Read More »
Chances are you might be reading this blogpost on a device other than a laptop or desktop computer. I’d also wager that the device you’re using to read this post handles double-duty – that is, you use it for both work (e.g., checking email, reviewing confidential documents) and play (e.g., Vine, Flappy Bird, social media).
You’re not alone. Everywhere you turn, you’ll see someone using a smartphone or tablet to be productive – both on corporate and non-corporate networks, for example, a coffee shop’s guest network. For enterprise IT, this means that the scope of managing an “enterprise network” has really expanded beyond controlling user access to a company intranet to controlling user access to company data across the “extended network” – wherever and however employees choose to do that.
The increased risk due to a larger “attack surface”, fundamentally changes how you approach access control and security. Traditional Network Access Control (NAC) was technology that, while complex and complicated to deploy, worked well enough when enterprise IT controlled the intranet and the procurement of allowed devices.
However, as the Enterprise Mobility, a.k.a. Bring Your Own Device (BYOD), phenomenon accelerated to become the new corporate norm, traditional NAC wasn’t as effective anymore, due to technology that was overly complex to scale with an overarching need for multiple 802.1X supplicants that generally targeted on more “traditional” endpoints like Windows PCs. As a result, enterprises turned to mobile device management (MDM) platforms as a new way to secure just those mobile devices. These MDM solutions were definitely easier and less expensive to deploy and manage than NAC and offered a tangible security ROI.
Even today, many organizations continue to use MDM (and its successor, enterprise mobility management or “EMM”) as a bit of a security silo to secure and manage these devices. However, as is implied, this strategy has a couple of caveats:
- MDM/EMM can enforce device policies (e.g., PIN lock, encryption, whitelisted applications) but offers zero enforcement capabilities for actual network access policies – e.g., restricting corporate network access to financial databases or sales document repositories. The device may be secured, but network access is potentially wide open.
- Obtaining 100% full compliance with installing/configuring the MDM/EMM agent on endpoints is nigh impossible, since the MDM/EMM solution works in isolation from other security solutions. Thus, compliance relies heavily on end-user cooperation and participation, which makes it highly likely that non-compliant devices could gain access to the network. From there, who knows what might happen, if the device is compromised.
The net-net here is that enterprises that leveraged solely MDM/EMM to protect their devices and networks are potentially achieving only part of their security objectives.
Fortunately, network access control platforms have seen a renaissance in the past few years and have evolved substantially. In my last post, I highlighted a recent white paper that discussed how NAC is evolving away from simply basic access or admission control and transforming into a more sophisticated set of controls for endpoint visibility, access, and security – technology dubbed “EVAS” by some. Unlike its overly complex and complicated ancestor, the newest generation of NAC solutions (or EVAS) utilize advanced contextual data gleaned from a number of different sources – including EMM/MDM – in order to enforce granular, dynamic network access policies. In essence, these solutions leverage the network as a sensor in order to make proactive access control decisions e.g., applying different access policy depending on the device being used or the compliance state of the device; or enforcing access to prevent unauthorized lateral movement across a network) throughout the extended network – regardless of how authorized users or devices connect.
This evolution has transformed NAC from a limited security hindrance into a powerful business enabler for enterprises, with more advanced solutions going beyond simple access policy and integrating with other network and security solutions to share data and improve the efficacy of all solutions. For example, here at Cisco, when I attempt to access the network with my iPad, the Cisco Identity Services Engine (“ISE”) (our NAC/EVAS solution) sees my device’s attempt to connect. It checks the profile and posture of the tablet to ensure that it is compliant with our mobile device wireless access policy (i.e., with MDM/EMM software installed). If not, Cisco ISE, which is integrated with an EMM/MDM software solution, redirects me to install that software first in order to become compliant before I gain whatever access my particular level of authorization allows on the network. With this integration between the two solutions, my tablet is now secured with the MDM/EMM software, and my level of access to network resources is seamlessly controlled, down to the letter, courtesy of the NAC/EVAS solution. Caveats solved.
Ultimately, this is just the beginning. Enterprises have realized that the “new NAC” can serve as a viable centerpiece for not only securing access but also for integrating with existing and previously silo’ed security and productivity solutions – like EMM/MDM – that may already be deployed in the enterprise network.
At the end of the day, NAC sure isn’t what it used to be…but that’s, actually, a very good thing.
For an additional perspective on NAC, market trends, and solutions, I invite you to look at the newly-released 2014 Gartner Magic Quadrant for Network Access Control (NAC).
To celebrate 30 years of innovation at Cisco (#We are Cisco), we’ve asked Cisco Champions what they think is the most important Cisco innovation to date. Cisco Champions are seasoned IT technical experts and influencers who enjoy sharing their knowledge, expertise, and thoughts across the social web and with Cisco. The Cisco Champions program encompasses different areas of interest, such as Data Center, Internet of Things, Enterprise Networks, Collaboration and Security. Cisco Champions are located all over the world.
(Cisco Champions are not representatives of Cisco. Their views are their own)
Here are their top answers.
Cisco Nexus Series
The most important innovation for me is the Data Center Networking Solution with Nexus Portfolio N2K, N5K, N7K, and N9K, that allows us to address all challenges for our customers. I really appreciate the new campus solution based on C6800 with IA switches which uses the same technology as FEX. It really simplifies architecture and reduces OPEX with a single point of management.
Network Consulting Engineer
@BBordereau Read More »
What’s new and trending for the industry? Well, predictions for the upcoming year as a motif is certainly not new but is definitely trending, considering the deluge of pundits concentrating their well-informed thoughts about which industry happenings will emerge through hyperbole and into reality. Amongst go-to industry resources I find myself perusing is LNS Research, who has chosen to break down their Top Three 2015 predictions by industry trend/topic: Industrial IoT; Industrial Energy Management; Environmental Health and Safety; and Asset Performance Management.
Another annual favorite that I’ve blogged about in the past—including commentary on Cisco relevance—is IDC Manufacturing Insights, who this year took on a refreshing, new format entitled IDC Futurescape: Worldwide Manufacturing 2015 Predictions. The team of IDC manufacturing practice analysts quantify and qualify their ten most critical imperatives to be addressed by global manufacturers in 2015 and beyond—based on the coalescence of technology and line of business interests—including a few that are very pertinent to Cisco’s Internet of Everything (IoE) initiatives:
- In 2015, customer centricity requires higher standards for customer service excellence, efficient innovation, and responsive manufacturing, which motivates 75% of manufacturers to invest in customer-facing technologies.
- By 2016, 70% of global discrete manufacturers will offer connected products, driving increased software content and the need for systems engineering and a product innovation platform.
- By 2018, 40% of Top 100 discrete manufacturers and 20% of Top 100 process manufacturers will provide Product-as-a-Service platforms.
- In 2015, 65% of companies with more than 10 plants will enable the factory floor to make better decisions through investments in operational intelligence.
Before the analyst predictions pushed their way onto my laptop screen, I was asked by Cisco’s press relations team to put forward my top 3 for the industry. So on All Saints Day, before heading out on weeks of travel to China, India, and several of the United States outside my home residence, I produced three ideas that didn’t make it to our PR megaphone. As part of this blog, I’ve decided to share these three predictions, with some relevant observations from my Nov-Dec travels and customer interactions …
During military battles, where one side of combatants is severely outnumbered by the other, it’s not uncommon to find a strategy called cannon fodder leveraged by the underdogs. Cannon fodder refers to poorly armed, poorly trained, and ill-equipped soldiers on the front lines who are sent in a charging attack designed to overwhelm defenders with numbers rather than superior strategy. It’s understood that the cannon fodder soldiers will most likely perish in an effort to exhaust the other side’s ammunition and manpower so that underdog’s soldiers at the rear have a chance to win the battle.
In the sales world, we see the cannon fodder scenario happening all the time. A customer puts a project out to bid in an effort to evaluate different proposals and select the best choice. It’s not uncommon, however, that the customer already knows what solution they are going to select BEFORE the project is put out to bid and is only going through the bid process due to company policy. This means that you could be spending enormous amounts of time and energy putting together proposals that have no chance of being considered. You are just cannon fodder to the customer – expendable resources that are just going through the motions to appease company management. Read More »