The devices that can't authenticate, and what to do about them
Printers, cameras, badge readers, medical and industrial equipment. They are a growing share of the network and none of them can run your endpoint agent.
- segmentation
- IoT
- OT
- Zero Trust
Zero Trust is usually sold as an identity provider plus an endpoint agent. Both are good. Neither can be installed on an infusion pump.
That gap is not a rounding error. In a hospital, a manufacturing plant, a university, or any building constructed in the last fifteen years, the devices that cannot run an agent are a large and growing share of what is connected — and they are disproportionately represented in incidents, because they are unpatchable, long-lived, and frequently invisible to the tooling that watches everything else.
Why they are the hard part
They outlive the people who installed them. A badge reader or a building controller is specified during construction, commissioned by a contractor, and then owned by nobody in IT. It runs for a decade.
They cannot be patched on your cycle, if at all. Vendor firmware, certification requirements, or a maintenance contract that voids on modification. Sometimes the vendor no longer exists.
They fail in ways that matter. Denying a laptop is an inconvenience. Denying the wrong clinical device or a line-control system is an incident of a different category, which is why teams are — correctly — cautious about enforcing anywhere near them.
The approach that works
Profile before you police. You cannot design a policy for a device class you have not identified. Discovery has to cover the equipment nobody thinks of as IT, which usually means walking the estate rather than querying a database.
Authorise by class, with a narrow scope. These devices cannot present a strong credential, so the authorisation has to compensate. A camera should reach the video management system and nothing else. A badge reader should reach the access control server and nothing else. When the credential is weak, the blast radius has to be small — that is the trade, and it is a sound one.
Use behaviour as a corroborating signal. A device claiming to be a printer that starts scanning the network is not a printer any more. Profiling that includes observed behaviour catches the case where the identifier was reproduced.
Give them their own segment and mean it. “We have a VLAN for that” is only a control if the reachability out of that VLAN is actually restricted and audited. A separate broadcast domain with unrestricted routing between segments is organisation, not security.
Agree the failure mode in advance. For clinical and industrial equipment, decide explicitly and in writing what happens when the access control decision cannot be made — fail open, fail closed, or fail to a restricted state. This is a business decision with safety implications, not a configuration default to be discovered during an outage.
What this means for the Zero Trust conversation
If a Zero Trust programme is scoped as identity plus endpoint, it will deliver real value for managed laptops and leave the least defensible part of the network untouched. The awkward question for any Zero Trust roadmap is simply: what does this do for the devices that cannot run an agent?
If the answer is “those are out of scope”, the programme has excluded the part an attacker is most likely to use.