Trusted Computing Group has expanded its interest in NAC to include the way devices behave once they have been admitted to networks, and the group is demonstrating this capability at Interop Las Vegas.
Formerly focused just on the security of endpoints before they are admitted to networks, TCG is announcing a new protocol to help coordinate network security devices so they can respond to threatening behavior of devices that have already connected to networks.
The protocol acts as a common language that security devices can use to upload data to a meta-data access point (MAP). The MAP then publishes that data to other devices on the network that have subscribed to it. The same protocol, called IF-MAP, is used to access posted data from the MAP.
Based on this composite store of security information, each device can make better-informed decisions about restricting devices deemed to be violating security policies.
For example, the MAP may publish that the configuration of a router has been changed by a device at a certain IP address. Security management software may use this data to determine that that act puts the IP address in violation of security policy. Via the MAP, the security management software can publish that the IP address should be blocked, and a firewall monitoring the MAP could block the IP address based on that notification.
The protocol could have other applications, says Stu Bailey, CTO of Infoblox, who helped work on IF-MAP. For instance, components of an automated supply-chain system could use the protocol to publish data to a MAP so other elements could make decisions based on more data, he says.
Using IF-MAP in a NAC framework provides a standard in which gear from multiple vendors can be used to perform post-admission NAC, something that is already possible on a proprietary basis via individual vendors. With the standard protocol and a MAP device, security gear that is already installed in networks could contribute to post-admission NAC.
Infoblox supplies the MAP for the IF-MAP demonstration at the TCG booth at Interop, but gear from Juniper and ArcSight could be used as well, says Steve Hanna, co-chairman of TCG's Trusted Network Connect program for NAC. He says open source groups are also working on a MAP platform.
TCG may later push for IETF approval of IF-MAP, but that has not been decided, Hanna says. The IETF is considering other TCG NAC standards as possible IETF RFCs.
