Slashdot Mirror
Cisco Updates Network Security Technology
* * Beatles-Beatles writes to tell us that Cisco has announced an enhanced version of its Network Admission Control (NAC) technology. From the article: "Under its NAC initiative, Cisco is developing a range of tools that let companies permit, deny, quarantine or restrict admission to networks based on an end user's security status."
This Cisco technology is implemented in terms of Trusted Network Connect, a specification published by the Trusted Computing Group. Alsee explains how and why major residential ISPs will eventually use it to condition customers' Internet access on acceptance of Trusted Computing measures.
""With this, we are selling NAC on switches, routers and on just about every product we sell," Gleichauf said, adding that Cisco now has over 60 vendors participating in the NAC initiative."
Now if only their Contract website was as easy to manage as their Linksys routers. I try to log in to their website to check the account status, and they make me jump through hoops and look for hidden links. It makes me wonder if any web designer works for them.
Saskboy's blog is good. 9 out of 10 dentists agree.
I'm just joking, of course. CEOs are typically the most informed of all employees at any given company.
But this is pretty cool. The problem, of course, is how to decide whether someone is "secure" or not without running a scan on that computer. It isn't like infected computers are going to run around flagging routers of their infected status.
I wonder how they will manage this type of security clearance system. If it works, this is one of those technologies that is right on time. If we can stop viruses from infecting whole networks by shutting infections out of the network, then they can't propagate very far at all.
Jesus saved me from my past. He can save you as well.
they've lost alot of my respect after they confiscated those books and ripped out "certain" pages.
perpetually dwelling in the -1 pits
The problem, of course, is how to decide whether someone is "secure" or not without running a scan on that computer.
Easy. Just make the computer run a scan on itself (using an approved dialer program) and then prove, using Trusted Computing techniques, that it ran the scan that it says it ran. These PDFs explain the process.
It looks like Cisco branded products are moving up the application layer to enterprise products. Perhaps plain IP is now a commodity - they have retained the Linksys brand and not folded the products into "Cisco."
The PCs mentioned in the article could be clients for their application oriented networking and message queueing architecture and product line.
Eh? NAC has been available on Cisco switches for a while now. Technically it's been available since they started supported 802.1x, and switches have been compatible with the Cisco Security Agent since it was developed about a year ago. In fact, I haven't heard of routers being used in conjunction with NAC, CSA, or 802.1x. The only admissions control routers have ever done is access lists, which of course are also supported on layer 3 switches.
Mr. Conover: did you actually do any research on the technology involved or did you just read through the glossies and spew out something you remembered from the CCNA class you took 5 years ago?
Yes, my only tool is a hammer. And you're starting to look like a nail.
Slashdot had a earlier post about Cisco not supporting IPv6, what about that?
Student Research and Development
Didn't OpenBSD do something like this?
Cisco's Internetworking Technology Handbook is a bit dated but a great base resource downloadable in pdf.
Pair the above with IBM's TCP/IP Tutorial and Technical Overview, and round things off by downloading Bable: A Glossary of Computer Oriented Abbreviations and Acronyms since you'll be in acrynom hell.
Probably few /.ers need the above but they've given me a good overview and reference.
For What it's Worth :)
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
They use CISCO's Clean Access Agent for all student connecting from the droms. It's that lets them dictate certainly setting before students are able to log on to the network. Like have an anti-virus package running and up to date, having a firewall running and up to date, and having automatic update turned on in Windows XP.
Be wary of anything that will lock you into other proprietary hardware. Cisco is running scared right now with Juniper and others right on their tail, so some of this is likely to further cement Cisco into client networks.
Yup, this will work awesome! Until virus creators / spyware creators / worms / trojans (blah blah) read this on slashdot, and reverse engineer it until they figure out how to distribute their viruses without being caught by the router... I'm sure it's not far off, mainly since cisco is so large, so everyone will be implementing this soon
The Internet will route around damage, including silliness like trusted networks.
But can a wireless mesh route around legislators and regulators who ban the transmission of electromagnetic waves for unauthorized wireless meshes? And can it choose a within-50-percent-of-optimal route that minimizes speed-of-light latency and processing latency? And can it route across large bodies of water?
This isn't a complaint about NAC, I actually like the idea.
But I bet the way it integrates with the OS is a bit of a kludge (I haven't played with it, just guessing). Most network OSs have methods to integrate with host based auth systems - kerberos, LDAP or some such. Adding a secondary auth to the switch (which from what I hear of these technologies, they do) seems a bit hacky.
It'd be great if the switch only let the client send auth packets to the kerberos / LDAP server, only enabling them to do anything else once the auth server has approved their login. Maybe a kerberised router that's actually a host that clients need a service ticket to route to anything else, and the KDC automatically sends a service ticket along with the Ticket Granting Ticket.
Just an idea. Would love to talk to somebody that's played with this stuff and get your ideas.
I wonder how this will work for non-Windows machines trying to gain access?
Somebody mentioned the Cisco Clean Access Agent in a previous post, googling around a bit shows that only Windows is supported for the AV/Patch scan, and this is easily bypassed by changing the User-Agent on the HTTP login page. Details here
Cisco's canned response is to use Nessus to determine the real OS, or write your own plugin. Although windows boxen are probably the most common, and the biggest threat, non-Windows products need some sort of working by-pass that doesn't involve simply spoofing the UA.
We've tried to deploy NAC locally. It's hell to configure the "CTA" (i.e. magic software that runs only on Windows). It's hell to configure the switches (docs? Like they help...) It's hell to configure Cisco ACS (does Cisco even *use* that PoS?)
NAC is great in theory, but it's Windows-only, it requires extra software on Windows boxes, it requires all of your switches to be NAC aware, and it requires a NAC aware authenticator.
Can you say "not going to happen"?
If someone else comes out with something similar that can be used in the real world, like 802.1x supplicants with a bit more smarts, it will deployed so fast that Cisco's NAC will be a sad memory.
NAC: Good in theory. Cisco "gets" routers. They don't "get" network administration.
Cisco Updates Network Technology Security.
Check out the RADIUS protocol. that does exactly that. RFC 1865, I think.
end user authentication with a side-order of bloat - supersized with a vendor lockin feature. I wonder how well non-cisco devices will work with the new NAC overlords?
Join the Slashcott! Feb 10 thru Feb 17!
This is nothing more than an advertisement.
Cisco is a late player to this game, and they're still catching up. They bought a company to bring this technology into the Cisco brand, and they're still working on "cisco-izing" the product.
Last time I checked this only works with Cisco hardware in the wiring closets.
Other than that, does it yet come close to the capabilities of Bradford's Campus Manager? Any college trying to lock down their resnet probably used Campus Manager.
Never ask for directions from a two-headed tourist! -Big Bird
Because you can trust Cisco with your security.
London's finest organic fairtrade coffee
But this is pretty cool. The problem, of course, is how to decide whether someone is "secure" or not without running a scan on that computer. It isn't like infected computers are going to run around flagging routers of their infected status.
One of the principle components of the NAC architecture is something called the Cisco Trust Agent. The CTA is an authenticator framework which allows for multiple third-party vendor plugins. There are existing extensions for several major anti-virus technologies, and also much broader solutions. Basically, when you first show up on the network at a hardware level, the NAC-enabled device (router, switch, etc...) sends a challenge. The CTA then responds with information about the machine generated by CTA itself and any installed plugins. (This also can include authentication, which makes things that much more secure). The response is relayed to a Cisco Access Control Server (ACS), which then makes a decision about the state (posture) of the machine and pushes down an appropriate set of access controls.
What's even cooler, is that products like the one I work on, are capable of "closing the loop" and fixing violations. If your virus definitions are out of date, we can kick of a scan. If you're missing a Windows hotfix, we can install it. If you password length is too short, we can fix that too. All this is done by associating workflows with existing (and proven) configuration and provisioning management solutions.
Citrix currently provides this ability with even more granular options with it's end-point analysis scans available with their access gateway's advanced access controls.
Normally you wouldn't think of Citrix to provide this type of networking functionality but with their new gateway appliances they provide a very nice solution.
It's also totally Windows specific. You must run yet another frigging Windows only background process on your system to make sure that your AV program is running and up-to-date. You must run Windows XP or greater so that Microsoft Group Policies can enforce patch levels and system policy settings.
That's dandy, really! And it's very very helpful to the already overworked Windows admins that run only Windows XP or greater and Cisco only networks. But, what about the Mac OS X users that can't run the Cisco agent and don't have Microsoft Group Policies? What about the Linux users? If I recall, companies like Novell were making major efforts to push Linux into server rooms and desktops everywhere. Not to mentions the countless "hardware" devices that run BSD for an OS/firmware. Will we have to eliminate all of these devices from the networks or will we have to make exception rules that defeat the security measures? Or will we have policies that are assigned to these devices based on MAC address, I know everybody loves MAC filtering and it's SO effective.
And frankly, I was more appalled than impressed. Way to cobble up the "mission critical" network system in a byzantine system involving PCs, centralized servers, and other cruft. An order of magnitude more of a hackjob than server-mode VLAN configuration. Bloatware for networks.
If they want to enhance security, they should be paring down their codebase for simplicity's sake and extensively testing it under hostile and high-stress traffic loads. Which I can say quite unequivocally, they don't do much. It took them years to even acknowlege that the fact you could crash a routing protocol by drowning out its signalling was just plain wrongheaded, and even now protecting the signalling as paramount has not been successfully drummed into developers heads in all areas of the codebase.
Someone had to do it.
Cisco Updates Network Security Technology is one word swap from being a great acronym.
Came from the New York City Launch( 4 hour Seminar )- a pre-filtered event for established Security Pros It got very good feedback from this learned bunch - Trend Micro is also one of their partners for this package. It seems very promising and effective
http://george-harrison.info/
In that case, the "damage" the Internet will route around is the United States. Simple.
Does "harmonization" of other countries' corporate-welfare laws with those of the United States, such as parts of the Australian "free" trade agreement, count as another form of damage? Once the harmonization virus hits the entire developed world, then where should I move?