Re: Bulk blocking of all devices in Aruba ClearPass?

[Jennifer Minella <jjx () CADINC COM>]

Hi Catherine,
The policy someone mentioned is the mechanism within ClearPass and they may have provided some additional info covering 
what you need. Outside of that, there are a few options/ways in which to feed that information to a NAC solutions. You 
can typically get posture info in a few ways:

  *   From the posture agent within ClearPass (OnGuard)
  *   From a supported MDM with direct integration
  *   From an API, log, or other external trigger with custom rules (e.g. from SIEM, firewall, endpoint security 
platform)

You may also want to check on the WIRELESS group WIRELESS-LAN () LISTSERV EDUCAUSE EDU<mailto:WIRELESS-LAN () LISTSERV 
EDUCAUSE EDU>, I see a lot of ClearPass conversations there.

Hope that helps!

-jj

___________
Jennifer Minella, CISSP
VP of Engineering & Security
Carolina Advanced Digital, Inc.
www.cadinc.com<http://www.cadinc.com/>
jjx () cadinc com<mailto:jjx () cadinc com>
919.460.1313 Main Office
919.539.2726 Mobile/text
[CAD LOGO EMAIL SIG]

From: Catherine Ullman <cende () BUFFALO EDU>
Sent: Tuesday, June 8, 2021 3:16 PM
Subject: Bulk blocking of all devices in Aruba ClearPass?

Greetings!

I've been asked to reach out and ask whether any of your institutions who use Aruba Clearpass have a policy or 
procedure for bulk blocking of devices in the event of something like a ransomware attack.  If you do any of you have 
such a thing, are you willing to share?  Thank you in advance!

Best,
Cathy


Dr. Catherine J Ullman
Senior Information Security Forensic Analyst
Information Security Office
University at Buffalo
cende () buffalo edu<mailto:cende () buffalo edu>



**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community