ISE prescriptive guide for IOT

damode — Wed, 24 Mar 2021 04:18:06 GMT

Is there a prescriptive guide on ISE for IOT devices ?

Re: ISE prescriptive guide for IOT

Mike.Cifelli — Wed, 24 Mar 2021 12:15:20 GMT

Link for ISE/NAC resources: Cisco ISE & NAC Resources - Cisco Community

HTH!

Re: ISE prescriptive guide for IOT

thomas — Thu, 25 Mar 2021 00:51:03 GMT

No prescriptive guide - It's really a process depending on your tools, environment (IT, OT, your specific vertical) and politics (Layer 8!). The Prescription is to identify and minimize (eliminate!) all unknown endpoints using whatever you've got (or can afford). Identify the areas you believe present the biggest risk(s) to the business and start there.

You will never have 100% automation. Just because you know What something is (according to a tool) doesn't tell you Who owns it, exactly Where it is located, When it was put there, or Why it is there at all. There will still be a strong need for some sort of asset management database or registration tool for various department owners or even individuals to add, update and maintain inventories of devices.

From top to bottom, more automation to least automation.

ISE Profiles and Profiling Libraries
Traffic based analytics
- Endpoint Analytics
- Industrial Network Director
- Cybervision
- Stealthwatch
- Cisco Security Technology Partners (using pxGrid to share context-in)
Analysis of ISE Endpoint attribute database - using Excel or EAT tool (iseeat.cisco.com) - to build your own custom profiles
Existing sources of truth that may either push to ISE via REST APIs or ISE may query (LDAP, SQL) for MAB authorization:
- Network Tools
- CMDB
- Existing network inventory / asset management database
- Control Systems
- custom device registration systems
ISE Device Registration Portal for BYOD devices
Direct Inspection (trace the cable!)

topic ISE prescriptive guide for IOT in Network Access Control

ISE prescriptive guide for IOT

Re: ISE prescriptive guide for IOT

Re: ISE prescriptive guide for IOT