© 2013 ForeScout Technologies, Page 1 © 2014 ForeScout Technologies, Page 1

© 2013 ForeScout Technologies, Page 1© 2014 ForeScout Technologies, Page 1

It’s Not Your Father’s NAC: Next-generation NAC


Challenges– Information security doesn't

have the continuous visibility it needs to detect advanced attacks

– Detective, preventive, response and predictive capabilities from vendors have been delivered in non-integrated silos, increasing costs and decreasing effectiveness

Recommendations– Shift your security mindset from

"incident response" to "continuous response”

– Favor context-aware network, endpoint and application security protection platforms …

– Architect for comprehensive, continuous monitoring at all layers of the IT stack…

Source: Gartner, Inc. “Designing an Adaptive Security Architecture for Protection From Advanced Attacks”, February 2014, MacDonald, Firstbrook

InfoSec Trends – Continuous Monitoring and Response


Continuous Monitoring & Mitigation Challenges

Inadequate Visibility Transient

DevicesBYOD

DevicesBroken Managed

Devices

Inadequate Collaboration

MDM

VA

Patch

APT

Detection-Mitigation Gap


Impacts to the Enterprise

Greater IT Security

Risks

GreaterIT Costs

Rogue devicesSystem breachData leakage

Compliance violation

Investigation

Mitigation

$

+IT Risks

+IT Costs


Desired State

Real-time Visibility + Coordinated Controls

Ticketing Remediation

SystemsManagement

EndpointSecurity

Wireless

SIEM Switches

MDM

AAA

Vulnerability


Complete Situational AwarenessReal-time Network Asset Intelligence


Architecture for Real-Time Visibility



WHAT? • IP Address• OS• Browser Agent• Ports/Protocols

1) Span port / TAP




1) Span port / TAP

Health?• Apps• Services• Processes• Registry• Patches• Encryption• Antivirus

2) Interrogate the Device




1) Span port / TAP



WHERE?• Controller IP• SSID• VLAN

WHO?• User• Name• Email• Title• Groups

3) Leverage your infrastructure (SNMP reads, LDAP, switches, wireless, VPN. etc.)


Architecture for Real-Time Visibility... and Control


1) Span port / TAP



WHERE?• Controller IP• SSID• VLAN

WHO?• User• Name• Email• Title• Groups

3) Leverage your infrastructure (SNMP reads, LDAP, switches, wireless, VPN. etc.)

Control at Device: • Alert the End User• Auto-Remediate

Control w/Traffic• HTTP Guest

Registration• HTTP Alerting• IPS• Virtual Firewall

Control w/Architecture• Dynamic ACL (SSH or

Telnet)• VLAN Change (SNMP

Write)• Shut off a port (SNMP

Write)• Push information to SIEM


Taking Visibility and Control to the Next Level

Physical Layer

Device / Peripherals

Operating Systems

Applications

User Information

User Behavior

Visibility Management ControlPolicy violationsAudited responsesTrouble ticket requests

User notificationUser “signed” acceptanceSelf-remediation

Worm quarantineUser hacking prevention

User nameAuthentication statusGroup membership

Role-based policyMultiple guest policies

Guest accessRole-based quarantine

Application installed, runningRegistry valuesCompliance reporting

Application whitelistSoftware remediation

Application blockingApplication enforcement

OS fingerprint (patch, services)Compliance reportingAntivirus reporting

Vulnerability awarenessPatch managementAntivirus updates

Process blockingRegistry locking

Device typeIP address, MAC addressUSB peripherals

Inventory managementDevice-based policyData loss prevention

Shutdown, disableMulti-home, 3G modem, USB blocking, worm prevention

Switch, port, VLANGeographic locationNumber devices on port

Role-based accessPolicy-based firewallVPN status

Port control (802.1X, SNMP)ACL andVLAN


Information Exchange and Response Automation

NGFW / VPN

AAA

Security Gateway

VA/DLP

SIEM

GRC

MDM / MAMHost

Controls

SystemManagement

Next-Gen NAC


Use Case Example: Threat Management

Is it authorized?

Is it attacking?

Is it breached?• Quarantine• Remediate• Investigate

Next-Gen NAC


Continuous Monitoring and Mitigation

Endpoint Mitigation

Endpoint Authentication & Inspection

Network Enforcement

Information Integration

Continuous Visibility

Next-Gen NetworkAccess Control


SIEM Interoperability

ForeScout App for Splunk

CFI Alert

http://10.42.1.136:8000/en-US/app/counterACT/dashboardMain

http://10.42.1.136:8000/en-US/app/counterACT/dashboardMain

http://www.google.co.il/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=vj6ciRZz2bfscM&tbnid=MeKXN7CTnNKLlM:&ved=0CAUQjRw&url=http://clipart-finder.com/&ei=Oyq_Uf27JsvDtAa89YAw&psig=AFQjCNHeuNqwkT3qbjVR5KPXdehBcUDNMQ&ust=1371569078682189

http://www.google.co.il/url?sa=i&rct=j&q=CounterACT+ForeScout&source=images&cd=&cad=rja&docid=d-HK3XZs1KUe9M&tbnid=eSHmnCCfd2HJQM:&ved=0CAUQjRw&url=http://awards.scmagazine.com/ForeScout%20Technologies%20for%20ForeScout%20CounterACT&ei=dE-xUY2rGcKn0AX4goGgAg&psig=AFQjCNF44E1T2xq507NKwlWfu8I4scCGQw&ust=1370660698294662

http://www.google.co.il/url?sa=i&rct=j&q=CounterACT+ForeScout&source=images&cd=&cad=rja&docid=J5lSsTp4uSv3eM&tbnid=VdyPOXzwuOQf8M:&ved=0CAUQjRw&url=http://www.stigroup.net/forescout/&ei=WE-xUc6cO-Hs0gW9qICwDg&psig=AFQjCNF44E1T2xq507NKwlWfu8I4scCGQw&ust=1370660698294662

http://www.google.co.il/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=rLI33g8peDbtcM&tbnid=i9FhU4430yi2nM:&ved=0CAUQjRw&url=http://gwob.org/partnership-with-splunk/&ei=E8k1UpXvJ4eThQf57YC4BA&bvm=bv.52164340,d.ZG4&psig=AFQjCNGvZGMAV_9Hz4Qq4Sk6eBjY6CaQYA&ust=1379342987360185

http://www.google.co.il/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=jqsgR_qrcpwn2M&tbnid=BdMGCL1F1oJpHM:&ved=0CAUQjRw&url=http://www.forbes.com/sites/tomiogeron/2013/08/05/security-firm-fireeye-files-for-175-million-ipo/&ei=ycg1Uu3LDdDwhQeIrIGYCQ&bvm=bv.52164340,d.ZG4&psig=AFQjCNFN71RutOJ8BAQTcA2HcM3zCpXa6A&ust=1379342909259151

http://www.google.co.il/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=8ZVORqNBccRsVM&tbnid=Gk_akJx4dcQoYM:&ved=0CAUQjRw&url=http://www.huntlogo.com/mcafee-logo/&ei=j9E1Uui5Gq2I7Aar3ICgCA&psig=AFQjCNEs9GGRttQHlL-JTwUMYt1Wd9MBKw&ust=1379345157769978

http://www.google.co.il/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=70Qe5uzf8abt2M&tbnid=D9OntpDTQQp4vM:&ved=0CAUQjRw&url=http://techday.com/tag/palo-alto-networks/&ei=cMk1Uu-3O8qZhQeElIGgDA&bvm=bv.52164340,d.ZG4&psig=AFQjCNG2FVjI2T-E0lXTkJoYELzaHSlBeQ&ust=1379343080512312


Vulnerability Assessment Interoperability


MDM Interoperability


Advanced Threat Detection Interoperability


The Players….

**NAC Competitive LandscapeApril 2013, Frost & Sullivan

*Magic Quadrant for Network Access Control, December 2013, Gartner Inc.

*This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from ForeScout. Gartner does not endorse any vendor, product or service depicted in our research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Garnter, Inc. "Magic Quadrant for Network Access Control," Report G00249599, December 12, 2013, Lawrence Orans.

**Frost & Sullivan 2013 report NC91-74, Analysis of the Network Access Control Market: Evolving Business Practices and Technologies Rejuvenate Market Growth” Chard base year 2012.


NAC features to look for

Fast and easy to deploy

Agentless andnon-disruptive

Scalable, no re-architecting




Infrastructure Agnostic



Works with mixed, legacy environment

Avoid vendor lock-in




Infrastructure Agnostic

Flexible and Customizable



Works with mixed, legacy environment

Avoid vendor lock-in

Optimized for diversity and BYOD

Supports openintegration standards


Pervasive Network Security an IT Game Changer

Pervasive Network Security

Documents

© 2013 ForeScout Technologies, Page 1 © 2014 ForeScout Technologies, Page 1