Securing networking infrastructure to meet financial institution grade toughness requires protection from unauthorized devices and potential security threats. Allowing only authorized users, devices, and systems to connect to the network. Over the past decade, every bank we talk to has turned to implementing a Network Access Control (NAC) solution to meet this need.
However, when we asked CISOs why they implemented a Network Access Control (NAC), the majority said regulatory requirements were the driving force.
Across the globe, regulatory bodies from industry and government have been working to help ensure financial institutions are able to protect their sensitive data and transactions. For example, the New York State Department of Financial Services requires written policies reviewed and approved by an internal governing body to cover, amongst others, controls for asset inventory, network access, and identity management (CyberSecurity Requirements for Financial Services Companies – PDF). NACs made up the natural way to check the box for the early versions of most relevant regulations.
But secular trends are forcing regulators around the globe to reprioritize risks and add new protection requirements.
Moving Beyond NACs
Like a general preparing for the last war, NACs new and old are designed for yesterday’s environment. They have not kept up with today’s trends. The move to the cloud, the hybrid work from home model, increasingly convoluted supply chains, decentralization (e.g., BYOD), proliferation of IoT, and the increasing availability of sophisticated physical attack tools reduce the effectiveness of even the most widely implemented NACs.
The approach of prioritizing regulatory needs over better security controls and risk mitigation needs has a shelf life as many global regulations either already or soon will require protection greater than what a Network Access Control (NAC) solution can natively provide. CISOs need to orient their organizations to creating solutions that already meet tomorrow’s security needs. And the stricter device level protections regulators are moving towards.
The Core Issues When It Comes to NACs
Implementation
Implementing a NAC can be complex and challenging, particularly for large and distributed financial institutions. It is well known that Network Access Control (NAC) implementation projects take longer than originally planned (sometime years) and cost significantly more than originally budgeted. Network Access Control (NAC) implementations require specialized skill sets that make identifying the suitable team an additional challenge. As a result, many Network Access Control (NAC) implementation projects don’t make it to original planned outcome and thus cover only a portion of the organization’s network infrastructure.
Maintenance
On-going management and maintenance of Network Access Control (NAC) systems is a known operational and administrative burden on the security IT team. It requires ongoing manual support to address and adjust NAC configuration to meet the organization changes.
Scalability
As financial institutions grow, the number of devices and users connecting to the network increases while network boundaries also change. For example, additional branches are added to or removed from the network, or additional types of devices are added or removed. Each change requires significant internal resources to test and update and extend the NAC. At the pace of changes in today’s world, the NAC is consistently behind, causing gaps in protection.
Cost
Due to the complexity and support that NACs require to work effectively, the costs, especially specialized labor, jump dramatically and create a barrier to acquisition and/or full implementation for smaller and medium-sized institutions. As a result of that, most projects fall short to complete full network infrastructure coverage.
False Positives
NAC systems are known to produce false positives, disrupting workflow by blocking legitimate users and devices. This is frustrating for any financial institution implementing a NAC and leads to unnecessary loss of productivity. False positives can emerge from a multitude of reasons, e.g., misconfiguration, outdated software, hybrid work environment, and many more. As a result of that, most NAC systems are not put in the enforcement mode. But rather left for visibility only.
Visibility
Most NAC profiling techniques do not provide sufficient visibility and context for IoT security and OT devices security. This is due to the diversity and complexity of IoT and OT devices, leading NACs to allow these devices to be based on only simple identifiers such as a MAC address or IP. This means that the NAC has no ability to track these assets or confirm their legitimacy on the network.
Security Bypasses
Talking with red teams and evidence from prior breaches show that NACs are not especially burdensome to bypass, whether through spoofing an identity or using hardware tools such as rubber duckies to control authenticated hosts. In addition, large visibility gaps make documenting ownership and firmware updates of risky assets impossible, leaving further security control gaps.
Regulation
As discussed, financial institutions are subject to many regulatory requirements and industry standards, (e.g. Official PCI Security Standards Council Site) and governmental privacy laws around the world. Ensuring compliance with all these regulations is challenging especially as they become more stringent in their asset inventory and access controls, requiring timely documented updates of all assets an organization owns. NACs are not designed to meet today’s challenges in creating asset inventories and documentation, leaving regulations un-fulfilled.
Addressing the State of NACs
How do we improve all these issues related to NACs and what can be done to address NACs’ original implementation goals?
The answer differs depending on whether an organization has already implemented a Network Access Control (NAC) to its fullest coverage.
To improve your Network Access Control (NAC) coverage, your best and most cost-effective approach is to add an additional defense layer that provides completeness and truth of assets connected to your network infrastructure. The data from this additional defense layer needs to include all assets. Regardless of if they are actively communicating, IoT/OT/IT or even peripherals, 802.1x compliant, or any other new category to find. The data needs to be fresh with near real-time updates and scale across your entire ecosystem without impacting production traffic, causing contention to the network infrastructure, or requiring additional hardware overhead to compensate.
NAC Journey Implementation
If you are early in your NAC journey or would like to complement your current coverage with an additional layer, there are a number of approaches you can take to either replacing the Network Access Control (NAC). Which will leave you in a better global security posture without the headaches or replace portions of the Network Access Control (NAC) implementation. The various approaches will be discussed in a future article. They include implementing Zero Trust Network Access, and utilizing what Gartner refers to as “lightweight NAC”.
In any of these approaches, complete visibility and asset identity truth again become critical to network infrastructure security controls. At the time of connection, devices need firstly to be discovered, correctly identified, assessed for potential risk and outcome to determine the suitability of access, and, if necessary, blocked.
If you need help along your journey of improving your Network Access Control (NAC) or moving beyond it, Sepio is here.
Talk to an expert. It will help you understand how to use Sepio’s patented technology to gain control of your asset risks.
Sepio is purpose built to solve these issues plaguing security teams by allowing for a complete, trafficless global solution that gives you ultimate visibility, true asset identity, and risk mitigation.
