HP Access Control Client Software manual Vulnerability to Risks and Risk Tolerance

Addendum to the ProCurve Access Control Security Design Guide

Updating the Access Control Design Process

Finally, note that—even when your endpoints run Windows OS—they may use third-party security software. NAP tests primarily for Microsoft solutions while the NAC 800 tests for a wide variety of third-party antivirus software, firewalls, and other security solutions.

Table A-3. Options for Endpoint Integrity Solution by Existing Network

Environment

Existing Network Environment	Option
Mixed environment	NAC 800
Legacy devices such as Windows 2000 endpoints	NAC 800
Windows Server 2003 only	NAC 800
Homogeneous Windows environment with Vista and XP endpoints	NAP
and Windows Server 2008

Examples. This addendum will provide examples for two hypothetical orga- nizations—ProCurve University (PCU) and ProCurve Inc., a corporation.

PCU must support the endpoints that students and faculty bring with them. Network administrators have enough of a challenge forcing students to install antivirus software. At the very least, they can allow students to use the software that they choose. If network administrators were considering only the existing network environment, they would select the NAC 800 for the flexibility that it brings to a mixed environment.

ProCurve, Inc., on the other hand, can enforce more uniformity for stations. To make employees as productive as possible, the company upgrades its stations every three years. As a result, all stations are running at least Windows XP, and some stations are running Windows Vista. In addition, the company is already upgrading its Windows servers to Windows Server 2008. If network administra- tors were considering only the existing network environment, they would select NAP because the company has a homogeneous Windows environment.

Vulnerability to Risks and Risk Tolerance

The NAC 800 provides several security benefits over NAP:

■As a hardware appliance rather than a service running on an OS, the NAC 800 receives more frequent test updates.

■The NAC 800 supports many tests including checks on security settings, hotfixes, updates, patches, and software—as well as deep checks into endpoints’ files. NAP focuses on checking Windows settings, Windows hotfixes, and Windows patches.

A-26