HPE Securing Emerging AI Infrastructure with Central NAC

Mathew George of HPE Networking shows how Aruba Central and its cloud-based Central NAC service support a zero trust approach for complex device estates. Using a fictitious manufacturer, the session covers AI-powered client profiling, tag-based detection of unexpected generative AI traffic, certificate-based authentication policies drawing on identity and endpoint systems, and automatic containment through forced reauthentication. George, a technical marketing engineer focused on NAC and zero trust, presented at Security Field Day 16.

George described weakly secured IoT devices as a growing risk now that attackers use AI to find and hijack them for botnets. Client Insights classifies devices from DHCP, user-agent, and flow telemetry sent by Central-managed access points, gateways, and switches. It draws on a data lake covering almost 3 billion devices. At a Dallas manufacturing site, deep packet inspection showed two thermostats sending traffic to OpenAI. George created a tag for the generative AI application category. Central reclassified the tenant in about two minutes, and Central NAC forced reauthentication, which moved the thermostats into a restricted role. Policies can also authenticate known camera vendors and return attributes to third-party switches, including Juniper. Corporate access requires EAP-TLS and supports no username-and-password methods. Policies can check certificate issuers, identity provider groups, and compliance data from systems such as Intune, Jamf, and CrowdStrike.

Delegates pressed for a clearer explanation of why a role changed, which matters when a help desk takes a call. George showed how to compare matching rules over time and said logging could improve. For hospitals full of legacy devices, he described layering MAC authentication with profiling, MAC registration, and multi-PSK. A 30-day behavioral baseline also flags anomalies such as unusual uploads within about four hours. Central NAC does not perform posture checks or HIPAA compliance checks itself. It ingests that data from third parties, and its integration list is growing, with five added in the past year, compared with roughly 150 for the on-premises ClearPass product. Client Insights profiling can already feed ClearPass, and fingerprints are anonymized and shared across tenants. George acknowledged that classification still relies on DPI and URL filtering, so Central cannot yet tell agentic traffic apart from ordinary generative AI use.