All companies have critical network resources and core servers that are essential to conducting business. However, financial institutions and financial services companies tend to have even more critical needs, conducting financial transactions 24 hours a day, 365 days a year and maintaining confidential, highly sensitive information about their customers. Network access control (NAC) is one option for financial organizations to provide a means of allowing legitimate network traffic, while protecting data and network resources from unauthorized access or attacks.
Financial sector IT concerns
Customers want simple, fast access to their financial information and the ability to easily conduct transactions. The needs of the customer are offset though by increasingly sophisticated attacks, as well as government and industry regulations that demand tighter security. Network and security administrators in the finance sector have a delicate balance to strike.
Remote workers, branch offices, and a distributed user base combined with a proliferation in the variety of devices capable of accessing the network make the task of protecting data more difficult. Adding to that complexity, the trend of industry consolidation requires that diverse, heterogonous networks be merged securely as well.
Protecting the network with NAC
Financial institutions have a number of regulatory requirements and industry mandates to comply with. Many of them govern how companies in the financial sector must protect their networks and their data.
Some regulations, such as the Sarbanes-Oxley Act, do not specifically address network security controls; however, it does require that financial information is protected by ensuring that there are policies and controls in place to ensure its integrity. Most companies rely heavily on their network and computer resources to generate, transmit, and store such data which brings the realm of network security into play in or
To continue reading for free, register below or login
To read more you must become a member of SearchFinancialSecurity.com
der to achieve compliance.
The NAC acts as the gatekeeper to the network, validating identity, verifying compliance with internal security policies, ensuring that the endpoint device has the prerequisite level of patching and the appropriate antimalware and firewall systems before it will allow the device to connect with the network.
Depending on the product used, and how it is implemented, NAC can enable policy management, authentication, access control, security remediation, as well as providing a compliance and audit trail. Not only can NAC deliver these aspects of network security and regulatory compliance, but it can automate them as well, freeing network personnel for tasks that require cognitive intervention.
Network access control functions
A comprehensive NAC solution that manages both pre- and post-access concerns and addresses security policies, endpoint compliance, and identity authentication and verification can be an effective tool for protecting network resources and sensitive data while also achieving compliance. Below is a description of network security controls and the functions of NAC that address them.
A NAC is not a silver bullet though. There are potential downsides that must be considered as well. NAC is subject to false positives, possibly blocking access to devices that are secure and comply with internal policies. It may also be subject to false negatives, allowing access to compromised or infected systems. One other concern, and perhaps the biggest for companies that place their trust in NAC, is if the NAC itself is compromised by an attacker. Organizations looking at NAC to protect their environment need to be aware of these potential issues and keep them in mind as they explore the available options.
About the author:
Tony Bradley is a CISSP, and a Microsoft MVP. He is a Director with Evangelyze, a Microsoft Gold Certified and Voice Premier Partner focused on unified communications technologies. Tony is also a respected expert and author in the field of information security whose work is translated and read around the world. He contributes regularly to a variety of Web and print publications, and has written or co-written eight books. In addition, Tony is the face of the About.com site for Internet / Network Security, where he writes articles and tips on information security and has almost 40,000 subscribers to his weekly newsletter. Mr. Bradley has consulted with Fortune 500 companies regarding information security architecture, policies and procedures, and his knowledge and skills have helped organizations protect their information and their communications.
