Endpoints

First, there must be a mechanism to determine the security posture of the endpoint machine before taking any decision for identity and access management. The endpoint assessment technologies currently available include:

• Agent-less: nothing is downloaded or installed on the endpoint host.
• Agent: An application is pre-installed or downloaded at the first connection.
• ActiveX or browser plug-in: this is downloaded to the endpoint when connection is attempted.
• Scanner: performs an IP based vulnerability scan to determine the installed patches, services etc on the endpoint.

The agent-less approach uses an end point’s administrative account to connect (via Windows RPC) to central user management systems for all the end points. The administrative overhead is considerable, adding to the cost of this approach.

In the agent base approach an agent application is pre-installed or NAC prompts for the installation of agent at the first logon of the user to the network. Agents not only assist in determining the posture of the endpoint, but can also do access control and reporting to the NAC server on the end user machine, with the inbuilt firewall. One of the disadvantages of agent based approach is that it works on the assumption that the agent will be pre-installed or will be installed at the first attempt of access to the network, which can be potential source of risk.


In the scanning method the NAC scans the end machine and, based on the scan result, the posture is determined for the next step of identity and access to network resources. This approach may or may not test the endpoint’s patch levels, Anti-virus definition files status, or file/registry value. Another issue is that of the time required to scan an endpoint, which may be exacerbated at peak endpoint activity due to simultaneous endpoint scans. With the ActiveX or browser plug-in technology, the plug-in is downloaded on the end point for posture determination and to report the compliance status of the end point. The advantages of this are comparatively less memory and CPU overhead.