Peter Christy

The NAC/NAP Solution

Some time ago Microsoft and Cisco solemnly promised to avoid a NAC / NAP food fight and apparently neither was holding King's X behind their back because last week they unveiled the solution. The target market is people who have interest in both NAC and NAP. In that context the NAC/NAP solution makes a lot of sense. Cisco no longer tries to have a distinct agent that has to be installed on Windows systems but instead provides code that Microsoft tests, integrates and automatically distributes with the O/S or Windows Update.  When enabled, the Microsoft side provides the basic posture assessment and then provides status to Cisco to set-up the network. The solution looks well thought out and a good mutual solution. Our (unanswered) question is "who cares?"  Someone who is really hot on the security solutions in Vista and NAP (as evidenced by a relatively rapid desktop conversion to Vista) probably has the least to gain from NAC. The ideal NAC customer seems to be one with a relatively heterogeneous (i.e. not all Microsoft) system solution.  Obviously all joint Microsoft and Cisco customers should be happy that they longer have to take sides.  We're curious to talk to one that intends to vigorously proceed on both paths.

A Funny Thing Happened on the Way to 802.1X

We had been supplicating the Cisco team for a NAC update and when it finally happened they talked about the latest revision of the Clean Access Controller (the Perfigo appliance) and showed us the latest long-term vision for NAC.  While you weren't paying attention it went from a network-centric strategy to an appliance strategy. Cisco we're sure wouldn't explain it exactly that way but now right smack dab in the "framework" there is a pesky appliance labeled NAC Server. It's not exactly the old 802.1X plus VLAN elegance. As they used to say on LaughIn:  "Very Interesting!"  It looks like a smart evolution for Cisco but it doesn't look like particularly good news for the many NAC partners. Film at 11?

IBM buys ISS; Whither Cisco?

For the last month or so various of our network confidants have been asking what we thought of the rumor that IBM would buy ISS.  My (Peter) consistent answer was to doubt that it would happen because of the potential impact on the strategic enterprise security partnership with Cisco. My conclusion was clearly wrong but why?  First, the purchase was by the managed infrastructure part of IBM, not the enterprise part or even Global Services. But still, when the analyst call was done product integration with Tivoli and the earlier MicroMuse acquisitions were discussed, and the Cisco relationship didn't even come up. As background, remember that a couple of years ago IBM did some really nice work identifying generic patterns in security solutions and defining best practices templates for those solutions. As part of that work IBM identified Cisco as a key partner because many of the application security control points were in the network and not on IBM controlled systems.  We still think that Cisco will be a network equipment provider of choice for IBM enterprise security solutions (given Cisco's 70+% share in enterprise networking that is bound to be true anyway).  But remember also that a key objective for Cisco is grabbing more enterprise IT budget share, and security is one of the most promising growth vehicles. The ultimate revenue division question is less who sells the network equipment but rather who sells the management and control systems. If those systems just came with the network devices it would be Cisco's business to lose. But it seems more and more that those solutions look like computer applications (e.g. the Cisco NAC server) in which case Cisco isn't necessarily the most likely server application vendor, especially if the solution has more integration "upward" (e.g. into identity and configuration data) than "downward" to the network devices. So maybe it does mean something for the Cisco IBM relationship, after all, if you "follow the money" as is our want.

Nouveau NAC

We sat through yet another briefing from a Network Admission Control (NAC) wannabe that explained how their product related to the original Cisco NAC definition (if they had been reading this newsletter they would realize that NAC in the network is dead).  Now that even Cisco admits that NAC includes a server of some form, the server-based solutions from companies like Lockdown look a lot more mainstream instead of the best you can do if you're not Cisco.  Lockdown Networks demonstrates that startups can be visionaries in important emerging markets.  Recently Lockdown has introduced its open iNAC (intelligent NAC) architecture as a NAC policy environment that enables third-party product collaboration, introduced a remote and branch office solution, demonstrated integration with Microsoft's Network Access Protection (NAP), announced plans to support Intel's Active Management Technology (AMT), announced support for managed switches from all leading switch vendors including its integration with the Enterasys Dragon IPS, announced support for MAC OS/X and, most recently, announced its co-development and licensing agreement with network security vendor AEP Networks.  The NAC market today is still mostly about shutting the door on open access in places like conference rooms and wireless access points, but Lockdown is a good example of how a "neutral third party vendor" can add substantial value for customers implementing a NAC solution.

The Threat Landscape (continued)

There was a TechEd "Threats" discussion that provided a lot more chilling details to the already sober INBOX panel that Peter ran just a few weeks earlier. The centerpiece was the publication of a report on the Microsoft Malicious Software Removal Tools results that Gates had referenced in his RSA Keynote (you can get it on the Microsoft website if you search for MSRT). The discussion very much confirmed the somber conclusions of the INBOX meeting and the significance of the virus / Trojan infection problem as part of other solutions like NAC. It certainly seems to reinforce the potential importance and impact of Vista.