Network access control (NAC) is the practice and technology of controlling which devices and users are allowed to connect to a network, and what they are permitted to access once connected, so that unauthorized or risky devices are kept out or confined.
What NAC is
Network access control, usually shortened to NAC, governs the front door of the network and the hallways beyond it. Its basic job is to decide, when a device or user tries to connect, whether they should be allowed on at all, and if so, what they should be permitted to reach. Rather than letting anything that plugs in or connects wirelessly have free run of the network, NAC enforces a policy: identify what is connecting, check whether it meets the rules, and grant, limit, or deny access accordingly.
A NAC system typically identifies and profiles each device as it connects, determining what it is and whether it is known and authorized. It can check a device's security posture, is it a managed, up-to-date machine or an unknown one, and then place it appropriately: a trusted corporate laptop onto the main network, an unrecognized device into quarantine or a restricted guest zone, a connected device into a segment limited to exactly what it needs. In this way NAC both keeps unauthorized devices out and confines the ones it admits.
Why NAC matters for ransomware
NAC addresses two risks that are central to how ransomware spreads. The first is unauthorized or rogue devices. An attacker who can plug a device into the network, or a compromised unmanaged device that connects, has a foothold from which to launch an attack. NAC reduces this by ensuring only known, authorized, and compliant devices get meaningful access, so an unexpected device is kept out or boxed into a harmless zone rather than handed the run of the network.
The second, and more important in a modern environment, is controlling what a connected device can reach, which directly limits lateral movement. By placing devices into appropriate network segments and enforcing what each may communicate with, NAC works hand in hand with microsegmentation to shrink the blast radius of any compromise. A device that NAC has confined to a narrow segment cannot be used to pivot across the whole network, so even if it is compromised, the damage is contained. This control over who and what is on the network, and what they can touch, is a foundational part of a defense that assumes some compromise will happen.
NAC and the healthcare device challenge
NAC takes on special importance, and special difficulty, in healthcare, because of the vast fleet of connected medical devices. On one hand, these devices are exactly what NAC is needed for: they must be identified, placed in appropriate segments, and confined to only the connections their function requires, so that a compromised pump or monitor cannot reach the patient database. On the other hand, medical devices complicate traditional NAC, because many cannot authenticate themselves the way a laptop can, cannot have software installed on them, and must never be accidentally blocked in a way that disrupts care.
This means NAC in a hospital has to be device-aware and care-aware. It needs to recognize and profile medical devices accurately, understand their legitimate behavior, and enforce access policies without the cooperation of the device and without risking a clinical interruption. Getting this right turns NAC into a powerful control over the hospital's largest and most vulnerable attack surface: it ensures every connected device is known, placed correctly, and confined to its proper lane, which is a direct and effective answer to the use of medical devices as entry and pivot points in a ransomware attack.
NAC in a layered, zero-trust defense
NAC is a natural expression of the zero-trust principle at the point of network connection: do not automatically trust a device just because it is on the network, but verify it and grant only the access it genuinely needs. In this sense NAC, microsegmentation, and least privilege are closely related, all working to ensure that connectivity is controlled and that any given device or user can reach only what it should. Together they build an internal environment where a compromise is contained by default rather than free to spread.
On its own, NAC controls access but does not detect or stop an attack that operates within the access it has allowed, so it is one layer rather than a complete defense. Its greatest value comes when combined with detection and containment: NAC confines devices to their proper segments, behavioral detection catches a device that starts acting maliciously within those bounds, and automatic containment isolates it the moment it does. For a hospital, this combination, knowing and controlling every connected device, watching how each behaves, and containing any that turns hostile, is exactly what turns the sprawling, hard-to-secure device fleet from the attacker's favorite avenue into a controlled and defended part of the network.
Why traditional NAC struggles with medical devices
It is worth being specific about why network access control, for all its value, has historically struggled in healthcare, because it explains what a hospital actually needs. Classic NAC was built around the assumption that a connecting device can prove who it is, typically by running software that authenticates it or by participating in a standard access-control handshake. Corporate laptops do this readily. Medical devices usually cannot: they often have no capacity to run an authentication agent, support no modern access-control protocols, and were never designed to announce and verify themselves on the network. A NAC system built for laptops can therefore end up unable to identify medical devices properly, or, worse, blocking them in a way that disrupts care.
What works in a hospital is NAC that identifies devices by what they are and how they behave rather than by what they can prove about themselves. By profiling a device from its network characteristics and traffic patterns, such a system can recognize an infusion pump or an imaging controller without the device having to authenticate, place it in the correct segment automatically, and enforce the connections appropriate to its type. This behavior-based, device-aware approach is what lets access control actually reach the fleet that matters most, delivering the benefits of NAC, every device known, placed, and confined, across the exact population of devices that defeated the traditional approach. It is a clear example of why healthcare security cannot simply be imported from the corporate world but has to be built for the clinical environment.
See also
Sources
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.