topic Re: BYOD and Security in Network Access Control

BYOD and Security

gurbinder.kabbay — Thu, 11 Jun 2020 14:07:26 GMT

HI All,

I am giving a Demo session on BYOD, But still I am bit confused that how BYOD covering the end point compliance/security. As we cannot implement posture on personal device with BYOD. And how we can ensure that personal device connecting to corporate Network is secure and will not effect the corporate network. Any explanation on this.

Regards,

Garry

Re: BYOD and Security

balaji.bandi — Thu, 11 Jun 2020 16:32:24 GMT

here is the good guide for BYOD :

https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867

Re: BYOD and Security

thomas — Fri, 12 Jun 2020 23:23:18 GMT

BYOD with ISE is all about device registration and potentially provisioning an 802.1X certificate to avoid credential stuffing attacks. For compliance you will need to do MDM/EMM posture/compliance with Meraki SM or a third party MDM vendor.

Also see http://cs.co/ise-webinars > Recorded Webinars & Training Videos > BYOD (Bring Your Own Device) to help explain some of this.

Re: BYOD and Security

gurbinder.kabbay — Mon, 15 Jun 2020 14:15:36 GMT

Hi Thomas,

Can we implement ISE Posture with ISE BYOD ? If Yes, then please share any documentation or Use case. Moreover, EMM is only for mobile or for personal laptops/ desktop machines as well.

Regards,

Gurbinder

Re: BYOD and Security

Greg Gibbs — Tue, 16 Jun 2020 03:01:40 GMT

Yes, you can use Posture in conjunction with BYOD. After BYOD enrollment, you would use a redirect-based Posture flow to deploy the AnyConnect Posture/Compliance modules or use the Web Agent. See ISE Posture Style Comparison for Pre and Post 2.2 for more information and Posture flow diagrams. Keep in mind that both Posture and MDM require ISE Apex licensing.

There is also a section on "Posture and Compliance in Cisco ISE" in the Webinars link that @thomas provided earlier.

Re: BYOD and Security

thomas — Tue, 16 Jun 2020 12:55:21 GMT

Read my response immediately above.