Page 162 - Courses

Logical Security: The Network Layer

• NAC System.
• Firewall.
• Data Loss Control.
• IDS/IPS.

NAC System

Network Access Control (NAC) is a system that logically controls access to the network. An NAC
system has the following characteristics:
• Computing devices are not allowed to access the network unless authorized.
• Computing devices can be separated to specific network segments or subnets.
• Logical access is enforced through policies, allowing only specific types of computing devices
and users to access specific areas of the network. Enforcement can occur on any network device
(switches, routers, etc.).
• Users and computing devices could be separated by groups and roles.
• NAC may require installation of an agent on each network device.

Security Risks

Risks for security within an NAC system include:
• The incorrect policy is applied.
• Implementation is cost prohibitive.
• Bring your own device policies may limit the use of NAC policy.
• Network alerts are not monitored or follow-up is not timely.

Controls

NAC system controls include:
• Changing default vendor-supplied account passwords.
• Documenting NAC rules are complying with policies or documented configuration.
• Adhering to the organization’s change control process.
• Minimizing access to modification controls lists.
• Monitoring network events (as they relate to NAC).

Suggested Audit Procedures

To perform an audit of an NAC system:
• Inquire into the appropriateness of the process used to implement NAC policy.
• Test that the process ensures compliance with the change management policy.
• Review the adequacy of NAC monitoring procedures.
• Connect a computer to various portions of the network to validate NAC policies are operating
effectively.

Firewall

Copyright © 2021 by The Institute of Internal Auditors, Inc. All rights reserved.