Securing networking infrastructure to meet financial institution-grade toughness requires protection from unauthorized devices and potential security threats. Allowing only authorized users, devices, and systems to connect to the network is crucial for NAC cyber security. Over the past decade, every bank we talk to has turned to implementing a Network Access Control (NAC) solution to meet this need.
However, when we asked CISOs why they implemented a NAC cyber security solution, the majority said regulatory requirements were the driving force.
Across the globe, regulatory bodies from industry and government have been working to help ensure financial institutions are able to protect their sensitive data and transactions. For example, the New York State Department of Financial Services requires written policies reviewed and approved by an internal governing body to cover, amongst others, controls for asset inventory, network access, and identity management (CyberSecurity Requirements). NAC cyber security solutions made up the natural way to check the box for the early versions of most relevant regulations.
But secular trends are forcing regulators around the globe to reprioritize risks and add new protection requirements.
Moving Beyond NACs
Like a general preparing for the last war, both new and old NACs are designed for yesterday’s environment. They have not kept up with today’s trends. The move to the cloud, the hybrid work from home model, increasingly convoluted supply chains, decentralization (e.g., BYOD), proliferation of IoT, and the increasing availability of sophisticated physical attack tools reduce the effectiveness of even the most widely implemented NAC cyber security solutions.
The approach of prioritizing regulatory needs over better security controls and risk mitigation needs has a shelf life as many global regulations either already or soon will require protection greater than what a Network Access Control (NAC) solution can natively provide. CISOs need to orient their organizations to creating solutions that already meet tomorrow’s security needs. And the stricter device level protections regulators are moving towards.
Challenges with Network Access Control (NAC)
Implementation Challenges
Implementing a a NAC cyber security system can be complex and challenging, particularly for large and distributed financial institutions. Network Access Control (NAC) implementation projects are well known for taking longer than originally planned, sometimes years, and costing significantly more than originally budgeted.
Network Access Control (NAC) implementations require specialized skill sets that make identifying the suitable team an additional challenge. As a result, many Network Access Control (NAC) implementation projects don’t make it to original planned outcome. Thus cover only a portion of the organization’s network infrastructure.
Ongoing Maintenance and Administrative Burden
On-going management and maintenance of Network Access Control (NAC) systems is a known operational and administrative burden on the security IT team. It requires ongoing manual support to address and adjust NAC configuration to meet the organization changes.
Scalability Issues in Growing Networks
As financial institutions grow, the number of devices and users connecting to the network increases while network boundaries also change. For example, additional branches or types of devices are added to or removed from the network. Each change requires significant internal resources to test and update and extend the NAC. At the pace of changes in today’s world, the NAC is consistently behind, causing gaps in protection.
Cost Considerations for Financial Institutions
Due to the complexity and support that NACs require to work effectively, the costs, especially specialized labor, jump dramatically and create a barrier to acquisition and/or full implementation for smaller and medium-sized institutions. As a result of that, most projects fall short to complete full network infrastructure coverage.
Dealing with False Positives
NAC systems are known for producing false positives, disrupting workflow by blocking legitimate users and devices. This is frustrating for any financial institution implementing a NAC and leads to unnecessary loss of productivity. False positives can emerge from a multitude of reasons, e.g., misconfiguration, outdated software, hybrid work environment, and many more. As a result, most NAC systems are not used in enforcement mode. But rather left for visibility only.
Visibility Issues with IoT and OT Devices
Most NAC profiling techniques do not provide sufficient visibility and context for IoT security and OT devices security. This is a critical gap in NAC cyber security, as the diversity and complexity of IoT and OT devices often lead to vulnerabilities. Leading NACs to allow these devices to be based on only simple identifiers such as a MAC address or IP. This means that the NAC has no ability to track these assets or confirm their legitimacy on the network.
Security Bypass Risks
Talking with red teams and evidence from prior breaches show that NACs are not especially burdensome to bypass, whether through intrusion methods, spoofing an identity or using hardware tools such as rubber duckies to control authenticated hosts. In addition, large visibility gaps make documenting ownership and firmware updates of risky assets impossible, leaving further security control gaps.
Compliance and Regulatory Challenges
As discussed, financial institutions are subject to many regulatory requirements and industry standards, (e.g. Official PCI Security Standards Council Site) and governmental privacy laws around the world. Ensuring compliance with all these regulations is challenging especially as they become more stringent in their asset inventory and access controls, requiring timely documented updates of all assets an organization owns. NACs do not meet today’s challenges in creating asset inventories and documentation, leaving regulations unfulfilled.
Enhancing Your Network Access Control (NAC) Strategy
How do we improve all these issues related to NACs? What can be done to address NACs’ original implementation goals?
The answer differs depending on whether an organization has already implemented a Network Access Control (NAC) to its fullest coverage.
To improve your Network Access Control (NAC) coverage, your best and most cost-effective approach is to add an additional defense layer that provides completeness and truth of assets connected to your network infrastructure. The data from this additional defense layer needs to include all assets. Regardless of if they are actively communicating, IoT/OT/IT or even peripherals, 802.1x compliant, or any other new category to find. The data needs to be fresh with near real-time updates and scale across your entire ecosystem. Should not impact production traffic, causing contention to the network infrastructure, or requiring additional hardware overhead to compensate.
NAC Journey: Implementation and Optimization
If you are early in your NAC cyber security journey or would like to complement your current coverage with an additional layer, there are a number of approaches you can take to either replacing the Network Access Control (NAC). Which will leave you in a better global security posture without the headaches or replace portions of the Network Access Control (NAC) implementation. They include implementing Zero Trust Network Access, and utilizing what Gartner refers to as “lightweight NAC”.
In any of these approaches, complete visibility and asset identity truth again become critical to network infrastructure security controls. At the time of connection, security teams must first discover devices. Correctly identify them, assess their potential risk and outcome to determine the suitability of access, and block them if necessary.
If you need help along your journey of improving your Network Access Control (NAC) or moving beyond it, Sepio is here.
Talk to an expert. It will help you understand how to use Sepio’s patented technology to gain control of your asset risks. Sepio is purpose-built to solve these issues plaguing security teams by allowing for a complete, trafficless global solution that gives you ultimate visibility, true asset identity, and risk mitigation.
