Network Hardening, NAC, and Access Control Lists

Hardening, network access control (NAC), access-control lists (ACLs), and screened subnets address different security boundaries. Using the right control begins with identifying whether the issue is device exposure, admission to the network, traffic between zones, or placement of an externally reachable service.

Control placement

1Unknown laptop connects        → NAC decides whether and how it joins
2Client reaches protected zone  → ACL or firewall policy controls the path
3Public web service is exposed  → screened subnet limits direct exposure to internal systems
4Switch management is enabled   → hardening limits services, sources, and administrator permissions

NAC is not a replacement for segmentation or ACLs. It controls admission and may assign a posture-appropriate role or segment. ACLs and firewalls govern the traffic allowed after admission. Hardening reduces risk on the device itself. Together, these controls provide defense in depth.

Practical hardening baseline

• maintain supported software and firmware;
• disable unused protocols, services, ports, and accounts;
• use encrypted management protocols and restrict their source networks;
• apply individual administrator identities and least-privilege roles;
• synchronize time and send protected logs to centralized monitoring;
• back up configurations and review deviations from the approved baseline.

A screened subnet is also commonly called a DMZ, although architectures vary. It is not automatically safe: access from the screened zone to internal services should be narrowly allowed, logged, and justified. See Network Remote Management for management-plane protection and Network Configuration Management and Backups for recoverable device state.