At Blackhat this year, Ofir Arkin (CTO of NAC vendor Insightix) attacks NAC. It would seem from reading some breathless press reports that major flaws and vulnerabilities have been discovered. The first article about this talk is from Dark Reading and was released almost a month ago. Here are a couple more recent from Infoworld, and Internetweek. Though I did not attend Black Hat this year I’ve reviewed Mr. Arkin’s slides. I have a number of problems with this entire brouhaha.
First, why are so few people reporting on the fact that Mr. Arkin works for a vendor which sells network access control products? In the Infoworld article the author makes no mention of this fact at all besides listing the company Arkin works for. Internetweek goes further by mentioning that Insightix is “an Israel-based developer of agentless, real-time IT infrastructure discovery and monitoring solutions.” Dark Reading is the only one of the three which tells the full story:
Not surprisingly, Insightix is offering products that could help close the vulnerabilities in NAC systems. The Insightix NAC solution, introduced three weeks ago, includes a network discovery tool that not only shows DHCP addresses, but static IP addresses and details on how clients and devices are connected to the network.
I’m no stranger to Black Hat–having presented twice–but both times I was listing design considerations in my own company’s products, not attacking my competitor’s approaches. This is grandstanding at its finest and I’m shocked that most of the media reports I’ve seen so far give Arkin a free pass. A quick visit to Insightix’s own website will make it very clear what role they see themselves playing in the industry.
Second, the posturing of this presentation to the press, to the Black Hat audience themselves, and what was actually delivered in the slides is quite different. First let’s compare a snippet from the InternetWeek article with the Black Hat abstract. First Internetweek:
“People need to understand that NAC is not bulletproof and that’s it’s something important that needs to be taken care of,” he [Arkin] says. “They might already have the right solution to handle their NAC issues, but they need to understand where to apply it.”
Pretty level-headed advice. Now the abstract:
Flaws associated with each and every NAC solution presented would be presented. These flaws allows the complete bypass of each and every network access control mechanism currently offered on the market.
Woah! This is clearly more incendiary and absolute in its damnation of NAC as compared with the press quotes. The grand claims in the abstract raise the question: what flaws were found which allow “the complete bypass of each and every network access control mechanism currently offered on the market?” Now again, I only reviewed the slides that were presented and heard from some of the folks in the room so some of this is conjecture (but hey, this is a blog right?). Since I haven’t seen the slides posted publicly yet, I’ll constrain this post to the flaws described in the press so that I can quote directly.
This leads me to point three: the flaws describes in the press–which should be among the juiciest–seem thin at best. Here’s a snippet from Infoworld:
NAC solutions that enforce access through network switches, such as Cisco Systems’ Network Admission Control, also have weaknesses, he said.
For example, Cisco’s NAC technology is specific to their switches and routers, but enterprises often use a mixture of switching and routing gear. Hackers can find their way into an enterprise network simply by finding and connecting through an unmanaged switch, he said.
Stop the presses; security controls don’t work on devices which don’t run them! Mr. Arkin is raising a very valid deployment concern which architects need to be aware of, but it reminds me of a deployment concern raised in the mid 90s around firewalls: If there are paths in and out of your network that don’t go through firewalls than your firewalls can be bypassed. Deployment concerns are not fatal flaws. However, there is a reason Arkin’s talk was titled “Bypassing NAC Systems” not “NAC Deployment Considerations.” First, as I know first hand, the Black Hat conference likes flashy titles. Second, so does the press. This is too bad because for the most part the information in his presentation presents useful design considerations around NAC as well as a substantial section providing an overview of NAC’s different approaches.
To wrap up, when evaluating a security control you should measure it against what you actually want to accomplish with it. As Mr. Arkin points out in his presentation, the definition of NAC is nebulous. Therefore describing ways to completely circumvent it seems confusing, even if he did point out novel techniques to do so. This is because without clear design goals and expectations, any system can be shown to fail simply by changing the target objective. This is why common criteria evaluations need to list what they say they protect against so that the measurement is accurate.
As I pointed out in a brief article from last year on NAC from a Cisco perspective, one of the most basic benefits that NAC can provide is to ensure systems that aren’t actively trying to subvert your security don’t become conduits in the proliferation of malicious code. Now I’m certainly no NAC zealot; I’ve written lengthy posts in the past on some of the challenges associated with NAC and I certainly agree that it has plenty of room for improvement. However, this and other elements of NAC’s functionality, have value which is in no way diminished by any of the “flaws” described at Black Hat. John Stewart, the CSO for Cisco (on the IT side of the company) said it well at the end of the InfoWorld article:
“The technology’s immature. But [NAC] will increase my capability to keep my network in good condition. Can it be maneuvered to have false data? Yes. Would it be completely the case that every device on my network will provide false data? Unlikely.”
“It’s inherently going to be found that there are weaknesses. But I think that’s the wrong thing to focus on. We want to address the weaknesses but focus on the benefits,” Stewart said.
I hope that as NAC moves along the adoption curve we can have level headed conversations about its use in networks and that the press, the vendors, and the researchers work together to find out the best way to protect against attacks. Eric Norlin’s more sober analysis is welcome. Also, I came across a very level headed article from earthtimes.org of all places which ignores the hype and just focuses on the useful info Mr. Arkin did present. This is where we need to head. After all, we all want a more secure network…right?
Technorati Tags: 802.1X, NAC, Network Security, Black Hat
