【正文】 lorer Windows Libraries Microsoft Office Windows Services Windows Configuration Weaknesses Mac OSX Linux Configuration Weaknesses Network Devices VoIP Phones Servers Network Other Devices Common Configuration Weaknesses * SANS Institute Top 20 Inter Security Attack Targets (2023 Annual Update), , Cross Platform Applications Web Applications Database Software P2P File Sharing Applications Instant Messaging Media Players DNS Servers Backup Software Security, Enterprise, and Directory Management Servers Security Policy Personnel Excessive User Rights Unauthorized Devices Users (Phishing/Spear Phishing) Sans Institute 2023 Top Attack Targets* 11 CONFIDENTIAL Preadmission (at work connect), 30% Postadmission (continuous monitoring), 7% Both, 60% Don39。t know, 3% What Class of NAC Solutions to Deploy? Aberdeen Research, 2023 12 CONFIDENTIAL 11% 12% 12% 17% 22% 24% 41% 42% 53% 59% 0% 20% 40% 60% 80%Meet regulatory requirementsReduce IT operations costImprove endpoint visibilityAutomate remediation of policy / configurationviolationsReduce time required to recover from malwareoutbreakImprove work uptimeEnforce security policy plianceEnforce endpoint software configurationsControl work access for staff, partners andcontractorsReduce incidents of malware propagation% of Respondents All RespondentsTop Drivers Influencing NAC Solutions Aberdeen Research, 2023 13 CONFIDENTIAL Top Features Required in a NAC Solution 6% 7% 11% 12% 14% 14% 16% 17% 19% 23% 24% 28% 30% 34% 37% 0% 10% 20% 30% 40%Visibility to endpoint configurationsThreat propagation detection / IDSScalability / fault toleranceReportingVisibility to endpoint threatsRedirection of users to remediation resourcesEndpoint configuration posture check (on admission)Ease of deploymentEndpoint configuration posture check (continuous/ongoing)Network infrastructure independentEase of managementPrevent infection of your endpoints by remote control,…Identitybased controlIntegration with current work infrastructureDay zero malware control% of Respondents All RespondentsAberdeen Research, 2023 14 CONFIDENTIAL Key Elements of NAC Solutions Common NAC Elements NAC is an evolving space with evolving capabilities NAC solution elements some or all ? Identify Detect authenticate new devices ? Assess Endpoint integrity checks to determine levels of risk and adherence to security policy ? Monitor Watch the device’s activity for change of assessed state with respect to policy and threat status ? Mitigate Take appropriate action upon any device that is identified as a security risk by previous three elements 16 CONFIDENTIAL Identify Find/Authenticate New Devices Question How do you know when a new device es on the work? Is it a known or unknown device? Is it an authenticated user? Common approaches ? Leverage or work infrastructure OS ? Authenticate through existing EAP infrastructure to pass credentials to authentication server ? Special purpose DHCP server ? Authentication usually web based and tied to authentication server ? Authentication proxy ? NAC solution serves as a proxy between device and authentication server ? Inline security appliances (. security switches) ? Serve as a proxy between device and authentication server ? Real time work awareness ? Authentication usually web based and tied to authentication server All approaches trigger off entry on the work by a new IP device 17 CONFIDENTIAL Identify Pros Cons of Various Approaches approach ? Pros: Device detected and authenticated prior to IP address assignment ? Cons: Often is a costly and time consuming installation ? Requires switch upgrade/reconfiguration ? Endpoints must be enabled requires supplicant software ? Must create guest/remediation VLANs DHCP approach ? Pros: Easier to deploy, independent of work infrastructure, covers both managed and unmanaged devices ? Cons: Bypassed by static IP address assignment, remediation typically to a broadcast VLAN (cross infection risk) 18 CONFIDENTIAL Identify Pros Cons of Various Approaches cont.