Don't Just Let them On

In the wake of the second out-of-band patch in two months (and during the holiday shopping season no less), I'm reminded of two NAC truisms.  The first is that, whatever your general view of patch checking in the NAC cycle, there are times when you absolutely need to check for the presence of a specific KB patch.  The second is that relying solely on IPS technologies for post-admission protection is foolish.

Don't get me wrong.  There remains an obvious place for IPS (though UTM seems a better fit), including a place in the NAC lifecycle.  However, as most data-stealing exploits indicate, there are times when you simply need to remove network access for an endpoint.  In these times, and especially at this time, allowing a data-stealing trojan infected endpoint onto the network under the premise that the "bad traffic" can be dropped remains the very last choice you'd want to make.