In early September, Forrester
published its “The Forrester Wave™: Network Access Control, Q3 2008.” Forrester’s
findings revealed that Microsoft, Cisco Systems, Bradford Networks, and
Juniper Networks lead the pack because of their strong enforcement and policy,
but that Microsoft’s NAP technology, despite being a newcomer, has become the
de facto standard.
Any time you try and put some order to vendor solutions, you are bound to find people in agreement – and to raise ire in others. However, reaction in the blogosphere to a recent Network World article on the research has raised some questions about Forrester’s Wave methodology which I’ll aim to address:
- Security Incite writes, “The Forresters checked out a
bunch of data sheets and decided Microsoft was “top of the NAC heap.”” If
only it were that easy! More than 150 hours of analysis went into the
Network Access Control (NAC) Wave, in which we analyzed more than 70
criteria (encompassing more than 200 attributes) for the 10 vendors that
were included in the study. The criteria was based on more than 200 client
inquiries I’ve fielded in my five-plus years covering the space.
- Our study was not based on the number of units sold or performance tests – it was based on real-world challenges faced by very large enterprises and not an academic exercise (for the record, the sky is blue in our real-world). Those common metrics are, for lack of a better word, useless. I know for a fact that several of the vendors in the study are giving their product away to gain market share, so how can unit volume equate to the quality of the product? Where does that fall on the BS-O-meter?
Performance tests are even less dependable because there are too many variables to consider and all too frequently are vendor-sponsored. Security Incite writes:
“…People that really buy products understand that a good RFP response gets you in the bake-off. That’s when things like “performance tests” start to matter.”
Since when is performance a critical factor in security? When’s the last time you heard a security pro say, “It doesn’t protect us, but boy does it scream with speed when it lets harmful users get by!”
Bottom line, I believe the NAC Wave was a fair, balanced and comprehensive study that looked at the products of 10 leading vendors in the space and concluded that Microsoft was the leader based on vendor strategy moving forward – even Security Insight and Security For All acknowledged it would be a standard in the future – and their presence in the market. While we may have to agree to disagree on the results, the methodology that helped us reach those conclusions should not be called into question.
Check out Rob's research

NAC is an ever evolving topic in its
definition and understanding. For me, NAC remains a curiosity. Our clients
crave deploying it, but remain stymied by its ever evolving nature. NAC today
is about enforcement, policy, and posture. Adding to the mix of these features
is better identity for your users and asset management for your non-computing
network attached end points. This last issue is actually becoming a real sore
point as more IP enabled devices start to show up on your network. IT managers
are brainstorming ways to track, monitor and manage end point devices such as
printers, faxes, IP phones, badge readers, HVAC systems, wireless access
points, etc. Yet most NAC solutions
today don’t adequately extend access control to these non-computing endpoints.
In fact, many just require you create a white-list and allow these devices to
bypass any authentication and access control framework.
NAC seems
to cycle between red hot and long droughts of disinterest. I think it suffers
serious issues, but the one that piques my interest the most is virtualization.
NAC is in danger of being irrelevant in a virtual world.
As mentioned in my last post, I was recently at Cisco’s C-Scape. One reporter asked me to comment on my thoughts regarding a specific announcement (if you can call it that): Cisco will begin go to open up IOS. So you’ve probably got the same question I had: ‘What does “open” mean?’ As best I can tell, it means providing some standards-based APIs so that IOS can be controlled by third-party applications and infrastructure. Seems interesting, but I feel there’s more to it than that.
It’s
that time of year. You know: shopping for the holidays, wrapping up end-of-year
projects, and the annual Cisco analyst conference, now called C-Scape. OK, so
maybe it’s not that big, but it has become an interesting event that acts a
proxy for the overall networking industry. This year was a dramatic difference
from years past. Namely, it was a lot more conversation with many more panels
and breakouts. However, it was also noteworthy in that there was really no news!
Cisco didn’t use this as a venue to announce any products or major initiatives.
In fact, when I bumped into Matt Hamblen he commented that many of the
journalists in attendance were bored!
However, there were some interesting nuggets for those
that follow Cisco:
Let me
first say that I haven’t actually spoken to Cisco on the topic, but I find the
news of the new CTO to be very interesting. It was recently announced that
Cisco is at an interesting crossroads. It’s approaching a $40B run rate, which it has achieved mostly through hardware sales. In fact, we recently did a full analysis of Cisco’s business and its current position looks rock solid (see our Q3 analysis
My recent research has focused on the impact of server, storage, and desktop virtualization on your networking infrastructure – and I’ll write more about that in a future post. In short, it’s a boatload of unintended consequences.