ConSentry Networks Delivers Simplified Post-Admission LAN Access Control at Gartner Symposium/ITxpo 2006; Automates Learning of User Role from Microsoft Active Directory to Simplify Role-based Provisioning.

SAN FRANCISCO -- ConSentry Networks, a leading provider of secure LAN solutions, today announced delivery of a critical new feature that automatically learns a user's role within Active Directory to enable user-based access control. With this "role derivation" capability in the LANShield operating system, the ConSentry LANShield Controllers and Switches now learn a user's role automatically during authentication to enforce role-based policies that control which LAN resources a user is authorized to access after being admitted onto the LAN. (NOTE TO EDITORS: ConSentry Networks will exhibit at the Gartner Symposium/ITxpo 2006 in San Francisco, May 14-18.)

The need for post-admission LAN access control is essential as organizations continue to open up their networks to contractors, guests, and an increasingly mobile workforce in an effort to improve business efficiencies and productivity. This increased openness, however, is exposing enterprises to significant security risks that go well beyond the protections enabled by network admission control initiatives.

Leading market research firm Gartner highlighted the need for user-based post-admission controls in a recent report. "Business trends such as outsourcing, insourcing and increased collaboration drive the demand to know exactly what contractors and guests (especially from other countries) are doing on the network," said John Pescatore, vice president and distinguished analyst at Gartner and one of the authors of the report.* He went on to note that "network managers should focus on solutions that meet their needs for mapping user identities to network traffic via integration with, not duplication of, IAM (Identity and Access Management) systems."

The new Active Directory role derivation feature is the latest ConSentry feature to leverage integration with customers' existing Active Directory and RADIUS identity management systems. ConSentry's LANShield devices are designed specifically to provide real-time user-based visibility into LAN traffic, tie all LAN activity back to specific users regardless of their network connection, and control where users can go on the LAN.

The addition of automatic role derivation from Active Directory simplifies IT's ability to set granular access control policies based on user status such as employee versus guest or user group within an organization. These controls ensure that only authorized users gain access to specific resources. For example, IT could easily create a policy in a LANShield Controller or Switch for a guest contractor working in an organization's engineering department. The LANShield device would automatically distinguish the user as a contractor versus an employee during authentication and, based on that role, limit the contractor's post-admission access to specific engineering department servers.

Continental Airlines, a ConSentry customer, already leverages role derivation to control post-admission user access for employees using information kiosks in airports. "With such a wide range of employees throughout our organization, it's imperative that we control who gets access to specific resources on our network to prevent potentially destructive security breaches," said Andre Gold, chief information and security officer with Continental Airlines. "Baggage handlers and flight crews have entirely different network access needs and rights, for example, and we can tightly control their LAN access with the ConSentry LANShield architecture."

The new role derivation functionality greatly simplifies post-admission control by leveraging user profiles already established and stored in Active Directory. By tracking Kerberos commands flowing across the LAN between the client device and the Active Directory server, ConSentry's LANShield Controller and LANShield Switch allows authenticated users onto the LAN and then queries AD for information about the users' groups, roles, or job title designations. ConSentry uses that information to apply access controls, so IT can set up and enforce post-admission policies quickly and simply since the role derivation function applies user profile content already stored in Active Directory.

"Having just won the prestigious 'Best of Interop' award for infrastructure for our LANShield Switch at the Interop 2006 conference in Las Vegas, we're well aware that 'Network Admission Control' is taking center stage among IT and security executives," said Tom Barsi, ConSentry's chief executive officer. "Many of today's NAC architectures stop short of providing post-admission control, however, so the introduction of our role derivation functionality comes at a critical juncture as key decision makers learn they need post-admission solutions as well as NAC to protect their LANs."

About Gartner Symposium/ITxpo

Gartner Symposium/ITxpo is the IT industry's largest and most strategic conference, providing business leaders with a look at the future of IT. For more than 10,000 IT professionals from the world's leading enterprises, Gartner's annual Symposium/ITxpo events are key components of their annual planning efforts. Attendees are responsible for more than $35 billion in IT spending for their respective companies, and rely on Gartner Symposium/ITxpo to gain insight into how their organizations can use technology to address business challenges and improve operational efficiency. For more information, please visit www.gartner.com/us/symposiumwest.com.

* Gartner report: "Finding from the 'Security' Research Meeting: Focus on Integrating User Identification Into NAC Deployments" by Lawrence Orans and John Pescatore from 13 April 2006.

About ConSentry Networks

ConSentry Networks delivers comprehensive LAN security, enabling businesses to protect their corporate assets, ensure continuity of operations, and dramatically reduce the risk of security breaches. ConSentry enables this pervasive security while lowering IT's cost of operations through its flexible, high-performance platform powered by ground-breaking custom silicon and revolutionary LAN security software. Backed by blue-chip venture capital firms that include Accel Partners, INVESCO Private Capital and Sequoia Capital, ConSentry is headquartered in Milpitas, Calif.

ConSentry Networks, the ConSentry Networks logo and LANShield are trademarks of ConSentry Networks Inc., for use in the United States and other countries. All other product and company names herein may be trademarks of their respective holders.