Chapter 5: Network Access Control and Cloud Security Flashcards
What does network access control mean (NAC)?
It’s an umbrella term for managing access to a network.
What three categories of components does NAC systems deal with?
- Access requestor (AR): the node attempting to access the network, can be any device that is managed by the NAC system. AKA, supplicants, or clients.
- Policy server: determines what access should be granted. Often relies on backend systems, including antivirus, patch management, etc, to help determine the host’s condition.
- Network access server (NAS): an access control point for users in remote locations connecting to an enterprise’s internal network.
What are 4 common NAC enforcement methods and what is an enforcement method?
Enforcement method: the actions that are applied to the AR to regulate access to the enterprise network.
- IEEE 802.1X
- VLANs
- Firewall: a form of NAC
- DHCP management
What is the extensible authentication protocol?
It acts as a framework for network access and authentication protocols. It provides a set of protocol messages that can encapsulate various authentication methods to be used between a client and an authentication server.
Supports multiple authentication methods.
Provides a generic transport service for the exchange of authentication information between a client system and an authentication server.
Shortly describe how the network access server (NAS) works?
ARs seek access by applying to some type of NAS.
- Authenticate the AR. This usually involves some sort of secure protocol and usage of cryptographic keys. Authentication helps in determining access privileges (and more)
- The policy server performs checks on the AR. The checks verify the users compliance with certain requirements from the organisations secure configuration baseline.
- When the AR is cleared it can access the enterprise network within its authorised level.
What is the IEEE 802.1X enforcement method
Link layer protocol that enforces authorisation before a port is assigned an IP address. Used EAP for authentication.
Describe the VLAN enforcement method
The network (set of interconnected LANs) is segmented logically into a number of VLANs. NAC decides which of the VLANs an AR will connect to, depending on if the AR needs security remediation, internet access, or some level of network access to enterprise resources.
Describe the DHCP management enforcement method
Dynamic Host Configuration Protocol. An internet protocol that enables dynamic allocation of IP addresses to hosts. A DHCP server intercepts DHCP requests and assigns IP addresses instead. NAC enforcement occurs at the IP layer based on subnet and IP assignment.
Limitations:
IP spoofing, thus providing limited security.
What 3 components exist in a typical EAP arrangement?
- EAP peer: client computer attempting to access a network
- EAP authenticator: access point or NAS that requires EAP authentication prior to granting access.
- Authentication server: a server computer that negotiates the use of a specific EAP method with and EAP peer, validates the peer’s credentials and authorises access to the network.
How does the EAP authentication exchange work?
The authenticator sends a request to the peer to request and identity and the peer sends a response with identity information.
This request-response continues until (1) the authenticator determines that it cannot authenticate (EAP Failure) or that it can (EAP Success)
Describe the IEEE 802.1X Port-Based Network Access Control
It was designed to provide access control functions for LANs.
Until the authentication server authenticates a peer (supplicant) only control and authentication messages are sent between the peer and the AS on the control channel.
When the peer is authenticated and has provided keys, data can be forwarded from the peer to the network on the data channel.
What is the difference between the 802.1X channel and the 802.11 channel?
The 802.1X is the control channel and it is unblocked, only used for control and authentication messages
The 802.11 is the data channel and it is blocked until a peer has been authenticated.
What is EAPOL?
EAP over LAN. It operates at the network layers and makes use of an IEEE 802 LAN, such as Ethernet or Wi-Fi, at the link level.
It enables a peer to communicate with an authenticator and supports the exchange of EAP packets for authentication.
