CybersecurityZero Trust & Network Access Control (NAC)
Check every user and device before it joins, with 802.1X and NAC. Plugging into a LAN port no longer means reaching the servers.
What we usually find on site
In many organizations anyone can plug into a meeting-room LAN port or join Wi-Fi and see the servers immediately. Personal phones, IP cameras and printers share a network with the accounts system. An attacker who gets in at one point can walk everywhere.
Zero Trust means "trust nobody by default, verify every time" and grant only the access that's needed. On the network, we make that real with NAC (network access control).
What NAC does
- Authenticates with 802.1X on wired and wireless. Our preference is certificate-based EAP-TLS. PEAP with AD passwords works too, but server-certificate validation must be enforced or credentials can be harvested.
- Profiles devices that can't do 802.1X, such as cameras, printers and IoT, and admits them via MAB with restricted access. MAC addresses are easy to spoof, so MAB must be paired with profiling and a tightly scoped VLAN.
- Checks posture: no EDR or missing patches means the quarantine VLAN.
- Assigns access dynamically: VLAN, ACL or security group tag by role, not by which port was used.
Rolling out without locking anyone out
We run in monitor mode for several weeks to build a full device list. Every time, we find devices nobody knew about. Then we enforce group by group. Segmentation between groups, CCTV versus finance for example, is enforced by internal firewalls. NAC also underpins guest Wi-Fi and BYOD onboarding.
What it does
Wired and wireless 802.1X
Certificate-based EAP-TLS, or securely configured PEAP with AD.
IoT profiling
Recognises cameras, printers and other devices automatically.
Posture checks
Machines that fail go to quarantine until fixed.
Role-based access
Any port, same rights, following the person and device.
Guest and BYOD onboarding
Structured registration and approval of new devices.
Micro-segmentation
Restricts traffic between groups so attacks can't spread.
Design and rollout
- 1
Inventory devices and group them by role
- 2
Deploy NAC/RADIUS with AD/Entra ID and PKI
- 3
Enable 802.1X in monitor mode on switches and Wi-Fi
- 4
Write policies and pilot with one group
- 5
Enforce group by group and add segmentation
Where it fits
- Banks keeping unknown devices off branch networks
- Hospitals with many connected medical devices
- Universities with student-owned devices
- Ministries separating internal and visitor networks
Typical system sizes
Foundation
Fits: One site, up to 300 devices
- 802.1X for staff Wi-Fi
- Separate IoT/CCTV/guest VLANs
- RADIUS tied to AD
Full NAC
Fits: 300–3,000 devices
- NAC platform with profiling
- Wired and wireless 802.1X
- Guest portal and BYOD
Zero Trust
Fits: High-risk multi-site organizations
- Posture tied to EDR/MDM
- Micro-segmentation via internal firewalls
- ZTNA for remote users
Brands we supply & install
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
FAQ
What about cameras and printers without 802.1X?
Use MAC Authentication Bypass (MAB) with profiling and put them in a VLAN that can reach only the NVR or print server. If someone spoofs a camera's MAC, all they reach is the NVR.
Will staff get locked out?
It's a real risk if you switch everything on in one day. We start in monitor mode, enforce one group at a time and have a rollback plan at each step.
Will our existing switches work?
Most managed switches support 802.1X and RADIUS. Advanced features like dynamic ACLs or CoA need checking model by model. Unmanaged switches won't work.
Related guides
VLAN Basics for Business: Keeping Guests, Cameras and Staff Apart
What a VLAN is, how 802.1Q tagging works, a sample VLAN/IP plan for a 100-person office, and how to migrate a live flat network without downtime.
Wi-Fi Security: WPA3, 802.1X and Guest Isolation That Actually Isolates
A Wi-Fi password taped to the wall and a guest SSID on the staff VLAN are what we find most. How to pick security modes, design SSIDs and VLANs, and move to WPA3 without…
Secure Remote Access: When VPN Is Enough and When to Move to ZTNA
How remote-access VPN and Zero Trust Network Access differ in practice, what to fix in your current VPN first, and how to handle vendors who want remote access.
Password Policy and MFA: Stop Forcing 90-Day Password Changes
Several classic password rules make organizations less secure. A policy based on the current NIST SP 800-63B, a comparison of MFA types, and a rollout order that works…
Managed vs Unmanaged Switches: Why Boxes That Look Alike Aren't
How unmanaged, smart and fully managed switches differ, when unmanaged is still fine, Layer 2 versus Layer 3, and the eight settings every managed switch should have.
Related solutions
Cybersecurity
Next-Generation Firewall (NGFW)A firewall that knows which app and which user, with IPS, web filtering, HTTPS inspection and VPN, sized on real all-features-on…
Secure Remote Access (VPN/ZTNA)Staff and contractors reach internal systems from anywhere through VPN or ZTNA with MFA, seeing only what they need.
Endpoint Protection & EDREDR that watches behaviour, not just virus lists. It stops ransomware mid-run and cuts an infected PC off the network at once.
Email SecurityStop phishing, fake boss and fake supplier emails (BEC) and malicious attachments with filtering, SPF/DKIM/DMARC and sandboxing.
SOC & SIEM MonitoringFirewall, server and endpoint logs in one SIEM, with people watching the alerts and a clear plan for when something happens.
Vulnerability Assessment & Penetration TestingScan and test systems, websites and networks to find weaknesses before someone else does, with a report ordered by what to fix…Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.