More Strategery, Less Crappery

In exchange for a permanent reprieve from Starbucks Duty, I promised my CEO that I would start a blog when MS released 2008 Server. Needless to say, I was pretty sure I'd be dead (or at least fired) by then. Well lo and behold, Microsoft managed to hit the (OK, this) date, so here I am. Does the release of MS 2008 Server portend the wide scale adoption of NAC? I certainly hope so, though I frankly can't help but remember that RFC 3580 compliant RADIUS servers have been out for a little while now. Not that the MS NAP initiative is without merit; after all, one can find something to like in any 106 page Visio diagram. Seriously, doesn't it seem like they could simplify it just a little bit? Cisco, for example, went from their own, err, large diagram to embedding "Simple" right there in the acronym.

So what really happens? The industry, much like political punditry, has no shortage of experts who are happy to tell you. Though no one has a crystal ball, and predicting correctly can be a challenge. Compare, for example, NAC predictions for 2007 to the pre Super Tuesday Zogby poll that had Obama leading in California by 13 points. Still, in the interest of not having to remember whether "non-fat" comes before "no whip," I just asked my own Magic 8 Ball whether 2008 will be the year of NAC.

The answer:  "Absolutely."  In the end, though, I think the answer will depend on the industry itself.  We need more strategery and less crappery.  At least part of me thinks that means we need fewer arguments over who builds a better mousetrap, and more open discussion on why organizations might not want mice to begin with.  Yet  what we heard consistently at OASIS (which was awesome, BTW, so thanks to all the customers, partners, analysts and press that attended) was that organizations get the basic value pitch for NAC; they need it in a package that is reasonable to deploy, comes at a reasonable cost and provides reasonable investment protection.  The pure play vendors have a much better story on the first two, if only because it's been more of a focus; the large vendors, by contrast, have little on the first two but get to default on the third.

And therein lies the rub, and brings us full circle to MS NAP and the release of 2008 Server.  I believe that the path for the pure play vendors to provide assurances of investment protection lies in the implementation of NAC standards, or at least one of them.  MS NAP, NEA and TNC all have common elements to them.  The challenge before us is to articulate a path through the standards soup, and provide both a vision and a product that is implementable today and relevant tomorrow.  Easy enough, right?

Absolutely.