HP Access Control Client Software manual Endpoint Integrity Posture, Quarantine Methods

Access Control Concepts

Network Access Control Technologies

Endpoint Integrity Posture

As a network access controller tests an endpoint, it assigns it a posture, depending on the results of the test:

■Unknown—Not yet tested

■Healthy—Passed all tests

■Check-up—Failed at least one test but allowed temporary access

■Quarantine—Failed at least one test (and a temporary access period, if allowed, has expired)

■Infected—Infected with malware such as a virus, worm, or spyware

The network access controller uses the posture to determine the action it takes (based on your particular configuration).

Quarantine Methods

Testing the endpoint determines whether or not it complies with your policies, but ascertaining compliance is only half the solution. The other half is taking action against non-compliant endpoints. Network access controllers typically quarantine non-compliant endpoints, isolating them from the main portion of the network.

While quarantined, endpoints have either no access to network resources or limited access. Resources made available to quarantined endpoints are often called remediation services because they help the endpoint become compli- ant. For example, quarantined endpoints might be allowed to contact a Web site for downloading patches.

Network access controllers quarantine endpoints in several different ways—not surprising because endpoints connect in different ways to net- works with different architectures and capabilities. The three standard quar- antine methods are:

■802.1X

■DHCP

■Inline

802.1X. As you should recall from earlier in this chapter, 802.1X is a standard method for enforcing access control in Ethernet and wireless networks. It provides a framework for hinging the status of the endpoint’s access port (open or closed) to the end-user’s authentication status.

1-42