3 ms·
> Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs to have root access to every system. Any syst
by formerly_proven 5y ago
> Everything connected to a company network is having to be audited for patches and approved OS installs. IT needs to have root access to every system. Any system not approved to be networked will be isolated at the switch to knock off the network and that team's other IT systems will be knocked off too.
It's not wrong to do any of this (it seems to be the norm, actually) but doing NAC kinda implies you're thinking of your intranet as some kind of perimeter to secure which is ultimately not that helpful and makes people lazy and complacent because "our service is just on the secure network, amirite?".
- orev 5y agoOne can make an argument like this about anything, and it’s just a defeatist attitude. Why bother to do anything then? The reality is that security should be done in layers, and this is an important layer. The handwavy “and then it causes everyone to become incompetent” type of argument is really just nonsense that needs to go away.
- legulere 5y agoNot necessarily. Your security model should be that any computer on your network could be infected. It’s very likely to happen and if there’s any flaw that allows infection it’s not your whole network that gets compromised.