Network Access Control Made Easy

At Your Service
NAC is a services-rich technology that quickly pays dividends for solution providers that make the necessary investment in training. However, VARs need to be aware that the sales cycles for larger projects can be as long as a year, and several solution providers told CRN that for those who are just getting into the NAC game, smaller projects are best.

Integrating NAC with Active Directory and developing access policies are examples of the types of services that have helped VARs such as Paul Graffeo, vice president of sales and marketing at RBTi, Atlanta, develop healthy NAC practices.

A high level of integration is required for health monitoring, the portion of NAC technology that ensures that devices accessing network resources and applications meet policy-based criteria for virus definition levels and quarantines non-compliant devices, according to Graffeo.

"You should be able to get 20 [percent] to 25 percent in services dollars for every NAC product you sell," Graffeo said. "Plus, you have a lot of project planning and post-implementation support services, and you can provide that augmentation for help desk, password reset and systems maintenance."

At this stage in the market's development, some solution providers have found NAC to be a complementary add-on technology to wireless or remote-access projects. These types of deployments also tend to have the shortest sales cycles due to their relative simplicity, Hogue said.

"We always try to get customers to focus on putting in NAC for remote access or for wireless to keep the scope limited, and then expand it later to more users and through the rest of the enterprise," he said.

For larger projects, especially ones that involve overhauling the network with 802.1x compliant infrastructure, solution providers need to gear up for sales cycles from six months to a year in duration.

"If you try to do the entire thing from the outset, you're going to have issues with cost, and you'll also need to understand the environment more, which requires more in-depth analysis that will obviously delay the sales cycle," Hogue said.

NAC is an educational sale, and a big part of that involves telling the story of how it can help clients, while also figuring out where it fits into their architecture, said Network Vigilance's Bybee. "Once the light bulb goes on, it's no problem, but takes a whole lot of positioning for that to happen for some customers," Bybee said.

In fact, translating the issue of how to mitigate risk is an area where solution providers often fall short when discussing NAC with customers, Bybee said. "That's an area where solution providers are struggling now, and you have to develop strategic selling skills in order to quantify that risk," he said.

Words Of Wisdom
There's a lot of mistrust in the NAC space today because of the earlier hype and because NAC solutions haven't been perfect. But the technology has come a long way in the past few years, said Atrion's Hebert.

"I think the market understands NAC and the philosophical need for it," he said. "But I don't think a lot of organizations understand how NAC impacts their network and why it would apply to their organization."

Selling NAC also can be difficult simply because it's a technology that requires the input of several different parts of an IT organization. But getting these disparate groups thinking in a federated way can help organizations tackle much of the notoriously thorny work around IT compliance, VARs said.

"Functionally, you have to include department heads to help with what policies their group has and what resources they have access to in order to implement the right access controls. But with NAC installed, you have three-quarters of the compliance puzzle done," Graffeo said.

However, to get NAC installed with a minimum of fuss, it's crucial for solution providers to start off with simple, barebones network access policies—otherwise, organizations can get overwhelmed and even decide to pull the plug.

"You have to scope it out very specifically at first, and you need to get them used to the policy before migrating to more complex policies," Network Computing Architect's Hogue said. "By minimizing what the policy is going to be at the outset, it becomes easier to have a successful implementation and easier to actually close out the project."

As NAC steams slowly toward mass-market adoption, solution providers have a window of opportunity to use their sales and technical skills to convince customers that they need the technology. And the time to act is now, because many solution providers believe that NAC eventually will become integrated into the network infrastructure.

"Now organizations have a choice to buy NAC, but in the future they won't have a choice because it will be integrated," Hogue said. "One thing's for certain, though: We're going to look back and wonder how we ever made it without NAC."

Next: Nine Key Players In The Network Access Control Market