Question

What types of things would you suggest to a manager be included in a Network Access Policy? Should users be allowed to bring their own equipment? Can users connect to the company's network? Can users do personal work on company issued equipment? Find an example policy that a company has and indicate whether you agree with the policy.

Answer 1

Answer:-

What types of things would you suggest to a manager be included in a Network Access Policy:-

• Authorization, Authentication and Accounting (AAA) of network connections
• Role-based control for a user, device, or application post-authentication. This means that a given user and their device are placed into their corresponding permission buckets such that an employee in finance and an employee in HR have access to different resources in their environment.
• Confidentiality and containment of intellectual property through policy enforcement
• Identity and asset management
• Automatically assess a device’s security posture, and allow or block based on if they pass the security check (which can be based on numerous things, such as operating system version, latest patches installed, a certain anti-virus is installed, etc.)

There are a number of use cases that cover all types of organizations using NAC solutions, according to Vinay Anand, VP of ClearPass Security at Aruba, an HPE company. These include the following:

• Access policy: This is the over-arching use case for NAC, said Anand. It allows the administrator to define multiple access policies that govern users and devices connecting to the network based on specific situations such as user profile, device type or user location.
• Compliance checks of endpoint devices: When a NAC client runs on end user compute devices, it can continually check and validate to ensure the appropriate software is installed, as well as confirming the devices have updated versions or patch management. If the device fails any of these compliance checks, it will likely be denied access to the network until appropriate updates are made.
• Guest access: There will be times that an organization needs to allow non-employees to access the network. An NAC solution can provide guests the ability to connect to the corporate network with restricted access.
• Device discovery and profiling: Due to the increased use of the Internet of Things (IoT), especially in particular industry verticals such as healthcare or manufacturing, the IT administrator needs to a comprehensive view of any and all devices connected to the network. Anand said in these situations, NAC is very useful as it has the capability to discover all devices on the network, and then fingerprints and profiles them so the IT administrator has a global view of what is on the network.
• Enforcement: There will be times when an unauthorized device or user attempts to connect to the network. When this happens, the NAC solution can automatically disconnect the device. There is also an option to quarantine the device until an investigation is done to determine if the device was supposed to be authorized and why it was exhibiting unauthorized behaviors.

Should users be allowed to bring their own equipment:-

any compromised devices accessing the network can pose risks and easily expose sensitive information. For personal devices, there is less company control over the maintenance of the device, and that is understandably scary for some employers.

It really boils down to management. It’s estimated that fewer than ten percent of companies know all of the devices that are connecting to their networks. While many organizations that allow BYOD have a policies in place, few of those manage their BYOD beyond policy implementation.

Employees don’t have information about the risks of using their devices. For example, they might access unsecured Wi-Fi networks with the same device that they access company networks on – sometimes even unknowingly. On the unsecured network they can easily pick up malware that compromises company assets.

Can users connect to the company's network? Can users do personal work on company issued equipment?

Every business involves the use of some sort of equipment which employees need to do their job, and this equipment is generally provided by the business. While some personal use of business equipment is realistically to be expected, problems can arise when the personal use is excessive.

Problems that can arise in the personal use of equipment that belongs to the business, such as computers, tools, or vehicles, include:

• broken equipment, which may cause disputes over who is responsible for repair
• lost productivity, as employees use work time for personal tasks involving business equipment
• premature wear and maintenance on the equipment
• morale problems if certain personal use habits are suddenly curtailed or if only some employees are allowed to use the equipment

No matter what your policy is or how much you try to control it, employees will probably use your equipment from time to time for personal purposes. The best way to handle the inevitable is to allow a reasonable amount of slack, but to be consistent and vigilant in creating and enforcing rules to make sure that the personal use doesn't get excessive.

Find an example policy that a company has and indicate whether you agree with the policy:-

ablets and smartphones are necessary business tools, and an increasing number of employees want to retire their company-owned hardware, opting instead to work from their personal devices. And while organizations are skeptical about letting workers save corporate data on the same gadgets where they download their favorite Justin Bieber songs, this trend can lower costs and improve workflow.

There are risks, however, the biggest of which is opening up your business’ network to viruses, malware, and security breaches. There is also the issue of protecting a company’s authority over data if an employee quits. As a result, businesses are looking to security experts for help in developing protocols for the BYO practice. “It’s definitely a huge growth area,” said John Pescatore, lead security analyst for Gartner Research.