ForeScout | Access Ability

Overview

ForeScout CounterACT for Network Access Control is an automated security control platform that lets you see and control everything on your network–all devices, all operating systems, all applications, all users. ForeScout CounterACT lets employees and guests remain productive on your network while you protect critical network resources and sensitive data.

Based on third-generation network access control (NAC) technologies, ForeScout CounterACT is easy to install because it requires no software, no agents, no hardware upgrades or reconfigurations. Everything is contained within a single appliance or virtual appliance.

Network access control is an ideal solution to help you optimize the productivity and accessibility of your network without compromising your enterprise security. Today, most attacks come from inside your network, bypassing the security provided by traditional firewalls and IPS systems. Modern threats include:

• Visitors–When guests and contractors come to your location, they bring their computers with them. To remain productive, guests need to access the Internet, and contractors may need additional resources. If you give these visitors unlimited access, you risk attack by malware or compromise of your sensitive data.
• Wireless and mobile users–Your employees want to use their smartphones and tablets on your network. If you don’t have adequate control, these devices can infect your network or be a source of data loss.
• Rogue devices–Well-meaning employees can extend your network with inexpensive wiring hubs and wireless access points. These devices can cause your network to become unstable, and they can be a source of infection and data loss.
• Malware and botnets–Studies show that even well-managed enterprises have infected computers because of zero-day attacks and/or out-of-date antivirus. Once your PCs are compromised, they can be used in “pivot attacks” whereby outsiders can scan your network and steal your data.
• Compliance–Endpoints can be misconfigured, and virtual machines can appear on your network without your knowledge, sometimes without proper security controls. Non-compliant systems are security risks.

ForeScout CounterACT automatically enforces whatever network access policies you desire for your organization. If you wish to ban all guests and unknown computers from your network, ForeScout CounterACT can do that. If you wish to allow guests and handheld wireless devices to access the Internet, ForeScout CounterACT can do that. Features include:

• Integrated appliance. ForeScout CounterACT includes everything in a single appliance. No software to install, nothing to configure. Built-in integration lets you leverage your existing infrastructure including directory, switches, endpoint security systems, patch management systems, ticketing systems and reporting systems.
• 802.1x or not. ForeScout CounterACT can utilize 802.1x for authentication and switch control. Or, you can avoid the limitations of 802.1x and use ForeScout’s alternative technologies. The choice is yours.
• Visibility. ForeScout CounterACT’s Asset Inventory provides real-time, multi-dimensional network visibility and control, allowing you to track and control users, applications, processes, ports, external devices, and more.
• Guest registration. ForeScout CounterACT’s automated process allows guests to access your network without compromising your internal network security. ForeScout CounterACT includes several guest registration options allowing you tailor the guest admission process to your organization’s needs.
• Real-time mobile device control. ForeScout CounterACT detects and controls hand-held mobile devices connected to your Wi-Fi network. Supports iPhone/iPad, Blackberry, Android, Windows Mobile and Nokia Symbian.
• Threat detection. ForeScout CounterACT includes ActiveResponse™, a patented threat detection engine which monitors the behavior of devices post-connection. ActiveResponse blocks zero-day self-propagating threats and other types of malicious behavior. Unlike other approaches, ActiveResponse does not rely on signature updates to remain effective, which translates to low management cost.
• Rogue device detection. ForeScout CounterACT can detect rogue infrastructure such as unauthorized switches and wireless access points by identifying whether the device is a NAT device, identifying whether the device is on a list of authorized devices, or identifying situations where a switch port has multiple hosts connected to it.
• Role-based access control. ForeScout CounterACT ensures that only the right people with the right devices gain access to the right network resources. ForeScout leverages your existing directory where you assign roles to user identities.
• Flexible Control Options. Unlike early generation NAC products that employed heavy-handed controls and disrupted users, ForeScout CounterACT provides a full spectrum of enforcement options that let you tailor the response to the situation. Low-risk violations can be dealt with by sending the end-user a notice and/or automatically remediating his security problem; this allows the user to continue to remain productive while remediation takes place.
• Policy Management. ForeScout CounterACT lets you create security policies that are right for your enterprise. Configuration and administration is fast and easy thanks to ForeScout CounterACT’s built-in policy wizard and knowledge base of device classifications, rules and reports.
• Out-of-band deployment. ForeScout CounterACT deploys out-of-band which eliminates issues regarding latency and potential points of failure in your network.
• Scalability. ForeScout CounterACT has been proven in customer networks exceeding 250,000 endpoints. ForeScout CounterACT appliances are available in a range of sizes to accommodate networks of all sizes.
• Clientless operation. Since ForeScout CounterACT is a clientless solution, it works with all type of endpoints–managed and unmanaged, known and unknown. Nothing escapes ForeScout CounterACT. If it’s on your network, ForeScout CounterACT sees it.
• Optional client. ForeScout CounterACT gives you the option to install either a persistent or a dissolvable lightweight client, giving you additional control over the endpoint. Client supports Windows, Mac and Linux and can be automatically deployed when the user connects to the network and registers their identity on the system.
• IT infrastructure integration. Unlike proprietary NAC products, ForeScout CounterACT is fast and easy to install because it supports an extensive range of third-party networking and security hardware and software, including both 802.1x and non-802.1x enterprise switches.
• Authentication. ForeScout CounterACT supports existing standards-based authentication and directories such as 802.1x, LDAP, RADIUS, Active Directory, Oracle and Sun.
• Reporting. ForeScout CounterACT has a fully integrated reporting engine that helps you monitor your level of policy compliance, fulfill regulatory audit requirements, and produce real-time inventory reports.
• Endpoint compliance. ForeScout CounterACT can ensure that every endpoint on your network is compliant with your antivirus policy, is properly patched, and is free of illegitimate software such as P2P.