A question we often hear when customers are looking at secure access service edge (SASE), security service edge (SSE) or zero-trust network access (ZTNA) strategies is: “If we’re already controlling access through identity and zero trust, why do we still need network access control (NAC)?”
It’s a good question. And the customers asking it are already ahead of the curve. They are the ones thinking seriously about access, identity, hybrid work and shifting the perimeter to the edge. Many were forced to think about it thanks to COVID-19.
The answer is not that their SASE architecture is wrong or that ZTNA is the silver bullet they’ve been looking for. It’s that access is not one single decision.
ZTNA is very good at controlling whether a user should be allowed to access a specific application, and SASE brings networking and security policy closer to distributed users. Those are important initiatives, but there is still a question that sits slightly before that.
What is connecting to my network in the first place?
Not just which user. Which device? From where? Is it managed? Is it compliant? Is it a laptop, a printer, a camera, a contractor’s device, a guest phone or something nobody has seen before?
This is where NAC still plays an important role.
A hotel is a useful way to think about it. A guest, a staff member, a maintenance contractor and someone attending a conference may all be allowed into the building, but they don’t all receive the same key.
The same applies to the network.
A corporate laptop may need access to internal systems and applications. A guest device may only need internet access. A printer may only need access to approved print and management services, not the wider corporate network. A contractor may need temporary access to a specific environment, not broad access because it is easier to configure.
NAC helps decide what kind of access should be given at the point of connection.
That doesn’t make it a replacement for SASE, ZTNA or firewalls. It makes it part of the access chain.
In the hotel analogy, identity and access management (IAM) is the bookings list, keeping track of who is expected to be there. Multi-factor authentication (MFA) is the ID check at reception. ZTNA is the keycard reader at each door, only allowing access to those who have the correct key. Firewalls are the security team managing movement inside the hotel. Privileged access management (PAM) is the manager’s override key, allowing access to restricted areas. NAC is the front desk deciding: should this guest receive a key, which floor is their room on, and which doors should it open?
Multiple controls. Many questions. None of which are answered by a single tool.
Most networks aren’t only made up of clean, managed laptops simply requiring access to an application. They have branches, boardrooms, warehouses, clinics, faculties, guest WiFi, old devices, new devices, shared devices and devices that do not belong to any user at all.
Some run an endpoint agent. Some don’t. Some are enrolled in device management. Some aren’t. Some were installed years ago and nobody wants to touch them because they still work.
This is where the visibility NAC provides becomes just as important as policy enforcement.
Most organisations have a good view of the devices they manage. The challenge is everything else. The printer that nobody thinks about until it breaks. The smart TV installed in the cafeteria to stream the World Cup. The contractor’s laptop. The old scanner connected to the branch in Gqeberha.
These devices are easy to overlook because they aren’t always part of the normal user, identity or endpoint management conversation. Unmanaged devices quickly become unmanaged risk.
No security tool removes risk completely. The real goal is to manage an acceptable level of risk for the business. NAC helps by giving organisations a clearer view of what’s connecting, classifying those devices and applying the right level of access instead of treating everything on the network as equal.
NAC can support the broader security architecture because it gives SASE and ZTNA controls more context about what devices are actually connecting to the network. It helps reduce blind spots around unmanaged and non-user devices. It also supports segmentation in a more practical way, because access can be based on role, device type, posture or policy rather than a static assumption like a MAC address.
Naturally, the firewall remains important, but it shouldn’t be expected to solve every admission problem after the fact. In other words, the firewall can’t be the bouncer if everyone is already inside.
Once an unknown device is on the network and communicating, the business is already dealing with an unknown risk. NAC helps by moving the policy enforcement to the point of connection.
For some organisations, NAC will strengthen an existing zero trust strategy. For others, it may be the first step towards one: a way to see what is connecting, apply the appropriate policy, reduce unnecessary access and start building a more secure edge without trying to solve everything at once.
Because sometimes the right place to start is not with a new framework. It’s with a simple question: who or what is connecting to my network, and what should they be allowed to do?
If this is a question your organisation is starting to ask, Intelys can help you explore what a practical NAC strategy could look like in your environment. To learn more, contact Intelys at sales@intelys.com.
Share
