Allied services have recently purchased NAC devices to detect and prevent non-company owned devices from attaching to their internal wired and…

The principle of least functionality, a core tenet of security hardening, dictates that systems should be configured to provide only essential capabilities. The scenario explicitly states the web portal for employee device registration "will not be utilized." Leaving this unused service enabled, especially a web-based portal with Active Directory integration, creates an unnecessary attack surface. An attacker could potentially exploit a vulnerability in this portal to gain unauthorized access or bypass the NAC controls. Disabling the service entirely eliminates this risk and directly enhances the security of the NAC installation itself.

A. Enforce company configuration standards for personal mobile devices

This is irrelevant because the stated policy is to block all non-company devices, not to manage them through a Bring Your Own Device (BYOD) policy.

B. Configure Active Directory to push an updated inventory to the NAC daily

This is an operational alternative to the existing mechanism of querying Active Directory. It does not inherently improve security over the current method of identifying corporate devices.

D. Change the wireless password following the NAC implementation

This is a general wireless security best practice but does not secure the NAC appliance or its configuration, which is the focus of the question.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Reference: Control CM-7, "Least Functionality."

Quote/Paraphrase: This control requires that organizations configure systems to provide only essential capabilities and restrict or prohibit the use of non-essential functions, ports, protocols, and services. Disabling the unused web portal directly aligns with this fundamental security principle to reduce the attack surface.

2. Center for Internet Security (CIS) Controls v8.

Reference: Control 4, "Secure Configuration of Enterprise Assets and Software."

Quote/Paraphrase: Safeguard 4.1, "Establish and Maintain a Secure Configuration Process," emphasizes managing and hardening systems. A key part of this process is disabling unnecessary ports and services to minimize potential attack vectors, which supports the recommendation to disable the unused web portal.

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Reference: Chapter 8, "Security in Computer Networks."

Quote/Paraphrase: University-level networking textbooks emphasize that a fundamental principle for securing network devices and servers is to minimize the attack surface by disabling any services that are not explicitly required for the system's function. An unused web portal is a classic example of such a service.