TechKnowSurge
CompTIA Security+ 4.5 ISC2 CISSP 4.2 NIST 800-53 CA-9 NIST CSF PR.IR-01 CompTIA Security+ 4.4 NIST CSF PR.PS-01
TechKnowSurge Catalog Videos Network Access Control (NAC)
VideoSecurityFree

Network Access Control (NAC)

Network Access Control (NAC) goes beyond 802.1X authentication by evaluating whether a device meets defined security requirements—such as patch status, antivirus currency, and endpoint protection—before and after granting network access.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network Access Control (NAC) is a security framework that extends beyond simple authentication to validate whether a device is actually fit to join a network. While 802.1X ensures that only authenticated devices gain entry, it does not evaluate the security posture of those devices—a machine loaded with malware or missing critical patches can still authenticate successfully. NAC addresses this gap by applying configurable compliance checks that may include operating system patch status, antivirus definitions and scan history, vulnerability assessment results, and the presence of endpoint security tools such as intrusion detection systems or endpoint detection and response solutions. Organizations define which criteria matter for their environment, meaning NAC policy can be as broad or as targeted as the use case requires. NAC enforcement can occur at two stages. Pre-admission control evaluates a device before it is allowed onto the network, blocking or redirecting anything that does not meet the defined standards. Post-admission control monitors devices continuously after they have connected, catching compliance drift that occurs during an active session—for example, a device that was fully patched at login but has since missed a critical security update. Many deployments combine both approaches to maintain consistent security posture throughout the device lifecycle. On the implementation side, NAC can be deployed with or without a software agent on the endpoint. Agent-based deployments install a dedicated NAC client that enables deeper, more reliable inspection of the device's configuration and security state. Agentless deployments rely on native operating system tools and require no pre-installed software, making them easier to roll out broadly but limited in the depth of checks they can perform. When a device fails compliance, NAC can either deny access entirely or place the device on an isolated remediation network where it can retrieve updates and patches before being re-evaluated and admitted to the primary network—a meaningful distinction between simple quarantine and a structured path back to compliance.

What you'll learn

What's covered

Network Access Control (NAC)

Aligned to

CompTIA Security+
4.5 Given a scenario, modify enterprise capabilities to enhance security.
4.4 Explain security alerting and monitoring concepts and tools.
ISC2 CISSP
4.2 Secure network components
NIST 800-53
CA-9 Internal System Connections
NIST CSF
PR.IR-01 Networks and environments are protected from unauthorized logical access and usage.
PR.PS-01 Configuration management practices are established and applied.

Key terms

Network Access Control
NAC
Network Access Control enforces security policy on devices attempting to connect to a network, verifying compliance with posture requirements such as patch level, antivirus status, and certificate validity before granting access.
Authentication
The process of verifying the identity of a user, device, or system.
Endpoint
Any device that connects to a network, including computers, smartphones, tablets, and IoT devices.
Patch Management
The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.
Endpoint Detection and Response
EDR
A security solution that continuously monitors endpoint devices to detect, investigate, and respond to threats.
Remediation Network
An isolated network segment where non-compliant endpoints are placed to obtain updates or fixes before being granted access to the production network.
Vulnerability Assessment
The process of identifying, quantifying, and prioritizing vulnerabilities in a system.
Antivirus
Software designed to detect, prevent, and remove malicious software from a system.

Topics

Network Access Control 802 1x Endpoint Compliance Agent Based Nac Network Security Remediation

Transcript

802.1X is great, but all it really does is authenticate a device. It doesn't check the device to see if it's set up properly to access the network. For that, we have something like network access control. So let's talk about network access control and what it does.

Why 802.1X Isn't Enough

802.1X will not allow a computer to access a network until it authenticates. This is a great starting point, but let's say this machine is full of infections. Maybe it has some viruses on it, maybe it has some worms on it, some malware that is causing it to malfunction. Maybe it's not updated or patched, or maybe it has some issues on it. 802.1X is still going to allow it onto the network as long as it authenticates.

But there is a mechanism that we can do to not allow this device to gain access to the network if it does have malware on it, or if things are not patched and updated.

What Network Access Control Does

Network access control is both a methodology and technologies that help us validate a machine and make sure that the machine is valid, that the user is valid, that the operating system is patched, antivirus is patched, antivirus has scanned the machine recently, that vulnerability assessment has been done on the machine, that there's some sort of maybe intrusion detection systems or intrusion prevention system on the machine, maybe some sort of endpoint detection and response.

Really, it could be any one of a number of things, so it doesn't have to be all of these things. It could just be a subset of these things. It's whatever we set up, whatever stipulations we want to put into place to make sure that this machine is going to be safe for the rest of the network when it gets added to the rest of the network.

Pre-admission and Post-admission

Now, when we set up NAC, network access control, what can happen is we could either set it up pre-admission or post-admission or both. So pre-admission just means that this machine, before it can connect to the rest of the network, is going to be checked. Does it meet certain criteria? If so, then it can join the network. Post-admission means, is it going to continually be checked after that? So we go back and we check this to say, hey, are you still in compliance?

So an example of this is that a machine might be patched and updated when it first joins the network. But if a zero day patch comes available, and it's never been disconnected from the network and it has not been updated, then a post-admission would then not allow it to continue to connect to the network until that update is made.

Agent vs. Agentless

When it comes to NAC, we can set it up with an agent or being agentless. If we are agentless, that means nothing's installed on this machine. We're just using the native tools on the machine to do checks on it before it accesses the rest of the network. Versus agent means that we install some sort of NAC agent on the machine, and that NAC agent helps us to monitor things.

This is obviously a little more to set up, with this agent-based, and they have to have the agent installed ahead of time. Versus agentless, you don't have to have it installed ahead of time. The problem with agentless is it's limited in the scope of what it can check, versus we have better checks involved if we have the agent installed.

When a Machine Fails the Criteria

Now, what happens if a machine doesn't meet the criteria necessary to join the network? Well, one is it could just deny that it can't connect to the network. Another thing that could happen is it could be placed on another network that is a remediation network. So in that case right there, maybe it's on this separate network where it can go out and get its updates and get patched, so that once it's patched and okay, now it can join the network that it's trying to join.

So there is a difference between quarantining this machine and making sure that it doesn't have access to anywhere, or giving it access to some sort of other network that it can perform some remediation steps to get up to speed so it can connect to the actual network.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →