All organizations face a constant increase in attacks from unknown devices attempting to access critical network infrastructure. When it comes to network security, every employee, customer, or supplier, and the devices they own, are a potential threat vector. Furthermore, for CISOs, Directors, and IT Managers, strengthening network access privileges and security compliance policies without restricting access for their employees and customers is a challenge. These managers and personnel also face the task of correlating device information with user identity for legal compliance and security forensics.
The value of SafeConnect NAC lies simply in its ability to significantly reduce security incidents by ensuring that every connected device is visible, checked for compliance in real-time, and consequently blocked or allowed in real-time. Don’t risk your organization’s reputation by disclosing your data; instead, ensure the security of your network, the personal information of your components, and your intellectual property remains intact.
Features and Benefits
Know what’s happening on your network.
Agentless device identification and profiling provides visibility into detailed information for devices on your network. This information primarily includes: Username, IP address, MAC address, Role, Device Type, Location, Time, and Ownership.
SafeConnect NAC uses advanced heuristic scanning and rich analysis to create robust device profiles:
Device discovery and profiling
SafeConnect NAC discovers new IoT and User Devices attempting to access the network.
SafeConnect NAC can passively create a profile (identify the device type) or quarantine the device until the device type is clearly known.
SafeConnect NAC uses the following techniques to identify device types:
- Deep Device Fingerprinting
- Web Browser User Agent Identification
- URL Fingerprinting
- MAC address OID fingerprinting
Inputs from external sources:
- Network devices in a sequence (wireless access points, firewalls)
- Database resources
Verifying your users’ identities
Depending on your environment, you can authenticate your users using multiple methods/protocols. End-User (AD/LDAP/SAML) Authentication prevents unauthorized users from accessing network resources.
SafeConnect NAC supports the following authentication types: EAP-PEAP (credential-based), EAP-PEAP (machine-based), EAP-TLS (certificate-based), as well as domain and 802.1X Single Sign-On (SSO).
Controlling IoT or Browserless Device Access
Whether they are printers, smart devices like VOIP phones, thermostats and lights, or industry-specific OT devices, controlling and monitoring these devices can be a real challenge. These devices can represent many of the risks in your environment, and many organizations are addressing this problem through network segmentation. SafeConnect NAC offers a consolidated view of traditional systems, mobile and IoT devices, and operational technology (OT) systems; it allows you to assign IoT devices to a specific VLAN using ACLs or from a single dashboard.
SafeConnect NAC allows for multiple options designed to meet your varying requirements for such devices:
- Passive Participation – You have the option to allow SafeConnect to recognize and passively access specific device types.
- Bulk Upload – You have the option to whitelist a group of devices whose MAC addresses are only held in your asset management system, and only those specific MAC addresses will be allowed to access the network.
- Self-Registration – If you are in an environment with specific IoT devices that require a linked ID, these can be self-registered via the restricted portal.
Evaluate comprehensive device compatibility.
Whether it’s your organization’s Acceptable Use Policies (AUP) or legal requirements, SafeConnect ensures that devices on your network comply. Windows, macOS, and mobile devices are checked with deep endpoint assessments to ensure they are controlled in real-time as they move across your network before network access is granted.
Meeting regulatory compliance requirements such as GDPR, HIPAA, PCI DSS, SOX, or GLBA involves knowing the answers to questions like “who, what, when, and where” for devices and users on your network, and controlling access to data that your company needs to secure. SafeConnect NAC helps you achieve visibility, security, and control, enabling you to comply with recurring audits by automating policies that validate accountability, mitigate vulnerabilities, and prevent evolving threats.
Secure access for guests, vendors, and third parties.
Self-Registration for Guests automates the process of granting temporary network access to your guests. Set different access levels and approval processes for guests, vendors, or other third parties who need access to your network. SafeConnect comes standard with a fully configured SMS gateway that provides international SMS support. Device Enrollment with Bulk Upload MAC Address enables authentication for browserless devices such as printers, VOIP phones, IP cameras, or other IoT-enabled devices with optional network access assignment (VLAN, ACL, Role, Profile, etc.).
View real-time or historical management reports.
SafeConnect NAC possesses rich, real-time or historically accurate contextual information, known as Contextual Intelligence, including Username, IP Address, MAC Address, Role, Location, Time, Ownership, and even Compliance Status. This information enables more timely and informed security decisions.
Use the Real-Time Reporting Dashboard for visibility into who and what’s on your network, along with a built-in reporting interface for 30 days of detailed device information and 6 months of historical data.
Additionally, a built-in reporting interface provides 30 days of detailed customer information and 6 months of historical session information via an easy-to-use interface that can be run on demand and programmed to send reports via email. This data can also be exported to an external source, such as a SIEM, for longer-term data retention.
Integrate to increase existing security investments.
SafeConnect NAC shares the contextual intelligence it gathers with other security solutions, such as identity-based firewalls, web content filters, SIEM, and bandwidth management solutions, to enhance capabilities far beyond those of traditional domain devices.