HP Access Control Client Software manual Factors to Consider for Testing Methods

Designing Access Controls

Choose Endpoint Integrity Testing Methods

all three testing methods are selected, the order determines which end-user access control screen is presented first to the user, which one is presented second, and which one third. For example, if the NAC EI agent is configured as the first testing method and the agentless is second, users will first see the NAC EI agent installation screen. If that testing method doesn’t work (for example, if the user refuses to download and install the NAC EI agent), the user will next see the agentless end-user access screen, which prompts for the endpoint’s administrator credentials.

Factors to Consider for Testing Methods

The sections below describe selecting testing methods for the five security zones. As you read through these sections, consider what it means to ensure that a particular method works in a particular zone. You might need to perform particular tasks on endpoints in that zone—for example, installing the NAC EI agent or opening ports. Or, you might publish the NAC EI agent in Active Directory for a group of users in that zone.

You should check the cluster settings that apply to the NAC 800 cluster that controls the zone. For example, if you are using the DHCP deployment method, the controlling cluster contains the NAC 800 that intercepts the endpoints’ DHCP requests.

Keep in mind that a cluster might control endpoints in more than one zone. This should not be a problem, however, because you can enable more than one testing method in a cluster.

To determine which testing methods you want to use, you should consider:

■Administrative control over endpoints

■Post-connect testing

■User sophistication

■Administrative workload

■Network overhead

Administrative Control over Endpoints

The amount of administrative control you have over endpoints determines whether or not you can configure endpoints to support a particular testing method. For example, if you have very limited control over endpoints, you cannot require users to download software to their endpoints. In addition, you will not know the admin credentials for endpoints, and end-users will probably not voluntarily provide these credentials.

3-69