HP Access Control Client Software manual Administrative Workload

Designing Access Controls

Choose the Access Control Methods

		Table 3-7.	Access Control Method by User Type and Sophistication
Factor	Private Wired		Public Wired	Private Wireless	Public Wireless
User type and	•	802.1X	Web-Auth	802.1X with WPA/	Web-Auth
sophistication	•	Web-Auth for the		WPA2
		administration
		building only

Administrative Workload

Do network administrators have the time and resources to implement the access control method?

Unless your IT department is in the unusual situation of having too many people and not enough work, the access control method you select should not require excessive administrator involvement. For example, if you were to use MAC-Auth for a zone that includes hundreds of devices, it would present an enormous challenge because you would have to collect numerous MAC addresses.

Sometimes, however, you must weigh the administrative burden against your company’s need for security. For example, universities must accommodate a new group of students each semester. If you use 802.1X security, you must update the user accounts each semester. This may create administrative overhead, although network administrators undoubtedly automate the pro- cess as much as possible. (“Choose RADIUS Servers” on page 3-78 explains how RADIUS servers can integrate with directories.) However, the university’s low risk tolerance and the danger of knowledgeable users with ample time to breach lax security outweigh the administrative burden. That is, most univer- sities can’t afford to implement a less-secure access control method.

Although you may be willing to incur some administrative overhead in imple- menting access control, you should also look for ways to limit the resources needed. For example, if you are using Web-Auth for guest access, you should provide documentation to help users log in to the network. By ensuring that the process is explained clearly, you can limit the number of calls to the help desk.

Example

Table 3-8 shows the access control methods the PCU network administrators select when factoring in only administrative workload.

3-24