Steve Jobs hates me. No, really. He personally goes out of his way to spite me. You doubt this? Well, I have proof.

First, he gave preference to the Macintosh instead of giving the Apple II the necessary upgrade to continue beating the PC (which it was totally doing). This led to the success of the PC and the untimely demise of the Apple II. Seriously. Look it up in Wikipedia.

Now he’s back to vex me again with tethering on the iPhone. Thanks a lot, Jobs.

With tethering, Jobs personally decided to add brings a whole new level of ease to mortals bringing laptops into the office that completely destroy any resemblance to network security. Because, as we all know, he personally writes all the code that goes into an iPhone and Mac. (Again, I’m serious. Look it up in Wikipedia.)

But I’m getting ahead of myself…

Laptops have always been the bane of system administrators everywhere. They are fragile, they go missing, and salespeople leave them on top of taxis. To add insult to injury, users drag countless viruses from home networks into the office, enable random strangers plug their laptops into the office network, and by being disconnected so often, are difficult to update with the latest patches, virus updates, etc. Really, laptops are a pain. I’ve started an Internet petition to ban them. Please sign it.

After one too many virus infestations, customers started asking networking vendors to get smarter about letting people onto the network. Network Access Control (NAC) and its various related technologies emerged that let network administrators validate that a user was indeed fully patched, updated, and who they said they were prior to allowing them onto the network. Guests would be relegated to non-critical networks where they would have limited access. A logical step.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The Need for Vulnerability Management
- - - - - - - - - - - - - - - - - - - - - - - - - - - - -

However, as laptops and netbooks gain Internet connectivity via mobile networks (e.g., 3G, WiMAX, etc.), administrators are forced to deal with a completely new class of threat: The dual-homed laptop. This laptop is, in essence, never secured. Access to the Internet (and the Internet’s access back) is direct and without the benefit of corporate firewalls, proxy servers, anti-virus, etc.  No amount of network infrastructure can protect against this.

So for as quickly as the time for NAC came, is the time for NAC gone? Can a user remain on the inside of a corporate network and readily bypass security as needed?

An argument against NAC’s demise could be that it is possible for policies to be defined and enforced limiting access by machines with multiple network interfaces. The problem with this approach is that an increasing number of laptops ship with multiple network interfaces that have valid reasons to be up. Most frequently, a user can be connected to both wifi and LAN, depending on the network configuration.

An argument for NAC’s demise (or at least reduced value) is that the enterprise is destined to treat the entire “inside” the way they trust a DMZ: physical presence in the network adds to credibility, but presence alone isn’t enough. In this scenario, the fact that laptops may be dual-homed becomes moot. They are treated as if they are connected from an untrusted network at all times and their network activity is managed as such. This isn’t unlike early value propositions made by SSL-VPN vendors circa 2003 where they sought to show value of a lightweight client within the newly emerging wifi enterprise.

Some vendors are seeing this in a similar light. Security startup FireEye sells an anti-malware appliance that has all the makings of an IDS that treats the internal enterprise as untrusted. Their early traction in the marketplace suggests that some enterprise IT folks agree.

The move to a completely untrusted network can be a good thing overall. It forces a more granular approach to security that requires a holistic view that includes individual hosts and applications instead of just networks. With implied trust completely out of the picture, improving our security posture as a whole improves. A net positive no matter what spin we put on it.

Hopefully we’ll get some discussion around this before Steve Jobs feels ignored and comes out to vex me again. I fear that next time he’ll taunt me by replacing the Mac’s underpinnings with OS7. I heard rumors about this already. Seriously. Look it up in Wikipedia.

Tags: network access control, Steve Jobs, tethering