Access Control Concepts

Network Access Control Technologies

Unfortunately, although forging these physical devices is difficult, the devices can be lost or stolen. A user might also allow someone else to access his or her endpoint—in fact, this might be a common practice in your organization. Once an unauthorized user possesses the necessary device, he or she can access the network easily.

■Something the user is—The previous two factors associate individuals with more or less arbitrary credentials. An increasingly important authen- tication factor, biometrics attempts to equate users and their credentials, which are physical characteristics, including voice, face geometry, finger- prints, hand geometry, handwriting dynamics, iris pattern, and retinal pattern.

In theory at least, a person’s physical characteristics are unique—and so unalterable and irreproducible. However, to live up to theory, biometrics require sophisticated, and often expensive, equipment. Privacy concerns also cause biometrics to be, while the most secure factor, also the least commonly used.

Each of these factors provides greater security when combined with another for two-factor authentication. For example, a smartcard or certificate installed on an endpoint becomes secure when combined with a password. Even if an unauthorized user seizes control of the device, he or she cannot use it without the correct password.

Authentication Protocols. An authentication protocol defines the procedure for submitting credentials to the authenticating device (typically, a network server).

RADIUS authentication comes in three forms, each of which uses a protocol developed for point-to-point connections:

■Password Authentication Protocol (PAP)

■Challenge Handshake Authentication Protocol (CHAP)

■Extensible Authentication Protocol (EAP)

You’ll learn more about these protocols and their role in network access control in “Authentication Protocols” on page 1-23.

Authorization

Authorization builds on authentication. Authorization determines which network resources an authenticated user is granted rights to access.

1-8