12.6. Internet Engineering Task Force (IETF) Network Endpoint Assessment (NEA)

The Internet Engineering Task Force (IETF) is a widely recognized and supported standards body. It has developed many of the standards in use today on the Internet. In October 2006, the IETF created the Network Endpoint Assessment Working Group (NEA WG). IETF has chartered the NEA WG with providing an open, neutral forum for vendors to come together so that they can collaboratively develop and produce a standard client-server interoperation for endpoint assessment, which is an integral NAC component.

Many different vendors and components need to come together to create the NEA standard, so it needs cooperation, collaboration, and interoperability. Any member organization in the IETF NEA WG can come together with it to agree on these standards, as well as how products can interoperate in this space.

The TNC Work Group of the TCG and Cisco are active participants in the IETF NEA WG, with representatives from each company serving as co-chairs of the IETF NEA WG. The IETF NEA WG focuses on creating and driving the success of the NEA standard, and any other standard or standards that the NEA WG develops and produces.

Although the IETF NEA WG hasn't published an official specification (at least, as of the writing of this book), they have published draft specifications. Fortunately, the NEA draft specifications are based almost entirely on the open, standards-based TNC specifications, which should ensure a smooth transition of the TNC standards from the TCG's vendor consortium to more traditional standards bodies.

For the sake of clarity, here are the differences between the IETF NEA WG and the TNC effort:

• The IETF NEA WG: Its charter and focus is to work solely on requirements and standards for client-server interoperability for endpoint assessment.

• The TNC: Focused on defining and delivering open standards and interoperability for NAC overall, including client-server protocols, but also dealing with specifications that extend NAC, APIs for client and server-side plug-ins, enforcement mechanisms, and so on.