CounterACT is an agentless, appliance-based platform for the enforcement of network access control on endpoint machines. The platform combines both NAC and intrusion prevention features.

The appliance itself is offered in four flavors: The CT-R, with 100 Mb/sec of bandwidth, 4 network ports, and support for up to 50 users; the CT-100, with 100 Mb/sec of bandwidth, 6 network ports, 2 optional fiber ports, and support for up to 250 users; the CT-1000, with 1 Gb/sec of bandwidth, 8 network ports, up to 4 optional fiber ports, and support for up to 1,000 users; the CT-2000, with 1 Gb/sec of bandwidth, 8 network ports, up to 4 optional fiber ports, and support for up to 2,500 users; and the new CT-4000, with support for up to 4 Gb/sec of sustained throughput and up to 4,000 concurrent connections. CounterACT operates out-of-band; it is typically spanned from a distribution-layer switch where it is able to communicate with and control switch functions, enabling it to take such actions as updating an ACL; relocating the endpoint to a quarantine VLAN; physically shutting down a switch port; etc. when non-compliant machines are detected.

In brief, an administrator first defines security policies and their respective enforcement actions. CounterACT watches network traffic as devices attempt to join the network; and when a new endpoint is detected it performs a scan for self-propagating worms or malware. Assuming this first scan passes, the system will then allow managed endpoints to access the network while the appliance performs a more in-depth scan of the endpoint for complete compliance with the administrator's defined policy. For unmanaged or non-OS endpoints, the appliance can reassign the devices into a designated VLAN. Optionally, unknown devices can also be prompted for permission to perform a scan of the device; in which case the user would need to relogon to the device. When non-compliant devices are detected, the appliance can take one of several actions by communicating with other network devices (firewalls, switches, etc.) as described above (a monitoring mode is also provided; enabling the device to monitor but not take immediate action). Monitoring of the endpoint continues while it is connected to the network.

Multiple appliances can be distributed throughout the network, with detection information shared among the appliances through the centralized Enterprise Manager (with support for up to 100 CounterACT appliances). The Enterprise Manager enables the multiple CounterACT appliances to be managed as one, and is a Java-based application that provides both policy management capabilities and activity reporting.

Other features of the platform include 802.1X integration, enabling the platform to leverage 802.1X admission controls in the enforcement of policies; rogue wireless detection; and network vulnerability assessment capabilities.

New features in the latest CounterACT release include:

- A "Secure Connector" client, which allows for connectivity to the CounterACT appliance (from the end point) by initiating an outbound SSL connection. The client is typically used as a 'dissolvable' client; but can be deployed in persistent mode, enabling it to remain functioning after initial installation. The client does not perform any scanning or interrogation of the end point.

- A new script engine facilitating customized, automated remediations. The vendor states that such scripts can execute or terminate any process running on the end point

- Support for multiple, logical remediation options (including time-based escalations) from within a single policy

- New detection capabilities including ARP spoofing, support for session-specific policies, open-port hardening, and extended support for VoIP devices

All of the CounterACT models are available now; pricing starts at $4,995.

Visit the ForeScout Technologies Web site for further information.

product submission by EITPlanet Staff

E-Mail this page to a colleague
send info about CounterACT

Suggest a link
for the CounterACT fact sheet