What is network access control?

Network access control is the act of keeping unauthorized users and devices out of a private network. Organizations that give certain devices or users from outside of the organization occasional access to the network can use network access control to ensure that these devices meet corporate security compliance regulations.

The increasingly sanctioned use of non-corporate devices accessing corporate networks requires businesses to pay special attention to network security, including who or what is allowed access. Network security protects the functionality of the network, ensuring that only authorized users and devices have access to it, that those devices are clean, and that the users are who they say they are.  

Network access control, or NAC, is one aspect of network security. There are many NAC tools available, and the functions are often performed by a network access server. Effective network access control restricts access to only those devices that are authorized and compliant with security policies, meaning they have all the required security patches and anti-intrusion software. Network operators define the security policies that decide which devices or applications comply with endpoint security requirements and will be allowed network access.  

One advantage of network access controls is that users can be required to authenticate via multi-factor authentication, which is much more secure than identifying users based on IP addresses or username and password combinations. 

Secure network access control also provides additional levels of protection around individual parts of the network after a user has gained access, ensuring application security. Some network access control solutions may include compatible security controls such as encryption and increased network visibility. 

If an organization’s security policy allows any of the following circumstances, they need to think carefully about network access control to ensure enterprise security:  

• Bring Your Own Device (BYOD): Any organization that allows employees to use their own devices or take corporate devices home needs to think beyond the firewall to ensure network security. Each device creates a vulnerability that could make it possible for cyber criminals to get around traditional security controls. 
• Network access for non-employees: Some organizations need to grant access to people or devices that are outside of the organization and not subject to the same security controls. Vendors, visitors, and contractors may all need access to the corporate network from time to time, but not to all parts of the network and not every day.  
• Use of IoT devices: The Internet of Things has given rise to a proliferation of devices that may fly under the radar of traditional security controls, often residing outside of the physical corporate building, but still connected to the corporate network. Cyber criminals can easily exploit these overlooked devices to find their way into the heart of the network without adequate network access controls. Network access control is an important aspect of edge security solutions. 

One important function of network access control is limiting network access to both specific users and specific areas of the network. So, a visitor may be able to connect to the corporate network, but not access any internal resources. This type of security control would have helped Target avoid the 2013 attack when hackers gained access to a third-party vendor’s network and attacked Target when the vendor connected to its network.  

Network access control can also prevent unauthorized access to data by employees. In this way, an employee that needs to access the corporate intranet still won’t get access to sensitive customer data unless their role warrants it and they have been authorized for that access.  

In addition to limiting user access, a network access control also blocks access from endpoint devices that do not comply with corporate security policies. This ensures that a virus cannot enter the network from a device that originates from outside of the organization. All employee devices used for company business must adhere to corporate security policies before they are allowed access to the network.