Most intrusions still arrive over a network path that should have asked "who are you and should you be here" and did not. D3-NAM Network Access Mediation is the MITRE D3FEND countermeasure for that question. D3FEND defines it as "the control method for authorizing access to a system by a user (or a process acting on behalf of a user) communicating through a network, including a local area network, a wide area network, and the Internet", gives it the synonym Network Access Control, and places it in the Isolate tactic under Access Mediation (D3-AMED). This card covers what D3-NAM isolates, why D3FEND currently shows no ATT&CK mapping for it, where it is implemented, how to prove it is enforcing, and where it stops helping. It is written for network, identity and detection engineers. For the whole Access Mediation family see the MITRE D3FEND Access Mediation Implementation Guide; for NAC product depth see the Network Access Control (NAC) Guide.
Key takeaways
- D3-NAM is the network gate, not the resource gate. It decides whether a user, device or process may reach a system over a network; what that subject may do on the service is its sibling, D3-NRAM Network Resource Access Mediation.
- D3FEND lists no ATT&CK techniques for it. D3-NAM isolates the Network artefact, and no ATT&CK technique in the D3FEND ontology acts on Network, so the inferred mapping is empty (checked November 2026).
- The work happens in its two children. LAN Access Mediation (D3-LAMED) covers 802.1X style admission to a local network; Routing Access Mediation (D3-RAM) covers VPNs, tunnels, firewall rules and traffic inspection.
- Identity is the weak point, not the protocol. A dormant VPN account with a leaked password passes network mediation unless the mediation ties access to a live, owned identity and a second factor.
- Prove it with denials. An enforcement point that never logs a reject, quarantine or blocked session is either perfect or not enforcing; test both the deny and the log line.
D3-NAM at a glance
| Field | D3-NAM Network Access Mediation |
|---|---|
| D3FEND ID | D3-NAM |
| Tactic | Isolate |
| Parent technique | Access Mediation (D3-AMED) |
| Child techniques | LAN Access Mediation (D3-LAMED), Routing Access Mediation (D3-RAM) |
| Digital artefact | Network (D3FEND: the technique "isolates" a Network) |
| Synonym | Network Access Control |
| D3FEND reference | Fortinet, "What is Network Access Control?" (cyber glossary entry); NIST SP 800-160 Vol. 1 Rev. 1 as see-also |
| ATT&CK techniques in D3FEND | None listed |
| Typical enforcement points | 802.1X switches and wireless controllers with RADIUS, NAC platforms, remote access VPN and ZTNA gateways, firewalls at zone boundaries |
| Main limitation | Valid but stolen credentials and trusted devices pass the gate; once admitted, traffic inside the segment is outside its scope |
What D3-NAM isolates
D3FEND's knowledge base article describes network access mediation as an intermediary layer between network access requests and the network resources, so that only authorised users and devices reach the network. The parent definition adds the expectations that matter in practice: decisions should enforce least privilege, grant access for scoped durations, use just-in-time access where applicable, and be able to deny at first connection or end access already granted.
The D3FEND hierarchy splits the job by layer:
- LAN Access Mediation (D3-LAMED): D3FEND describes strict access control policies, systematic verification of devices and authentication to govern connection to a Local Area Network. In most estates this is IEEE 802.1X port-based authentication with RADIUS, plus MAC Authentication Bypass for devices that cannot run a supplicant.
- Routing Access Mediation (D3-RAM): D3FEND describes control at the network layer using VPNs, tunnelling protocols, firewall rules and traffic inspection. This is the remote access gateway, the inter-zone firewall and the ZTNA connector.
NIST SP 800-207 gives the design principle that separates useful network mediation from a perimeter that trusts everything inside it: zero trust assumes no implicit trust is granted to assets or user accounts based solely on their physical or network location, and authentication and authorisation of subject and device happen before a session with a resource is established. See the ZTNA Guide for the remote access form of that idea.
How 802.1X carries the decision
RFC 3580 (Informational, September 2003, updated by RFC 7268) describes how 802.1X uses RADIUS. Three attributes turn an authentication result into network mediation:
| RADIUS element (RFC 3580) | What it does | Mediation use |
|---|---|---|
| Access-Accept / Access-Reject | The authentication server's decision; the authenticator should act on this, not on EAP content inside it | Admit or keep the port closed |
| Tunnel-Type = VLAN (13), Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID | Dynamic VLAN assignment in the Access-Accept | Place users, servers, printers and guests in different segments |
| Filter-Id | Names a filter list to apply to the session (layer 3 filters need a layer 3 device) | Restrict what an admitted device can reach |
| Session-Timeout with Termination-Action = RADIUS-Request | Sets the reauthentication period | Time-limit admission, as D3-AMED expects |
RFC 3580 also sets the hygiene for the RADIUS path itself: authenticate and integrity-protect RADIUS packets, use a shared secret of at least 16 octets, and never reuse the 802.1X shared secret for PAP. See the RADIUS Security Guide.
ATT&CK techniques and D3-NAM
D3FEND relationship: none listed. D3FEND derives its offensive links from shared digital artefacts. D3-NAM isolates Network, and no ATT&CK technique in the D3FEND ontology reads, modifies or otherwise acts on Network or its sub-artefacts (Local Area Network, Wide Area Network, Intranet, Internet, OT and bus networks), so the D3-NAM page lists no offensive techniques (checked November 2026). Do not report D3-NAM as "covering" any technique on the strength of D3FEND.
That does not make it irrelevant to testing. The table below is NHI Mgmt Group's own view of ATT&CK v20 techniques whose first step usually crosses a network gate, so they are good test cases for D3-NAM. It is not part of D3FEND.
| ATT&CK ID | Technique | What network mediation changes (NHI Mgmt Group view) |
|---|---|---|
| T1133 | External Remote Services | Remote access only through a mediated gateway with identity, device and second-factor checks; no direct exposure of RDP or SSH |
| T1078 | Valid Accounts | Limited: valid credentials pass, unless mediation also checks device posture, account state and MFA |
| T1200 | Hardware Additions | 802.1X keeps an unknown device off the production VLAN or places it in quarantine |
| T1021 | Remote Services | Inter-zone rules restrict which sources can reach administrative ports |
| T1046 | Network Service Discovery | Smaller reachable surface from any one admitted segment |
| T1199 | Trusted Relationship | Partner and supplier access mediated per connection rather than through a standing site-to-site tunnel |
See the T1133 External Remote Services Defensive Guide and the M1035 Limit Access to Resource Over Network, the ATT&CK mitigation closest in intent (D3FEND does not link M1035 to D3-NAM).
Where it is implemented
| Enforcement point | D3FEND child | What to configure | Decision telemetry |
|---|---|---|---|
| Wired switches and wireless controllers with 802.1X | D3-LAMED | EAP-TLS with device certificates where possible, dynamic VLAN or filter per role, quarantine VLAN for failed posture | RADIUS Access-Accept, Access-Reject and accounting records |
| NAC platform | D3-LAMED | Device profiling, posture checks, MAC Authentication Bypass list kept small and owned | Admission, quarantine and reclassification events |
| Remote access VPN | D3-RAM | Identity provider sign-in with MFA, per-group address pools and ACLs, session lifetime | Tunnel establishment, teardown, authentication failures |
| ZTNA broker or identity-aware connector | D3-RAM | Per-application access with device and user signals, no network-wide tunnel | Per-session allow and deny with subject and destination |
| Zone firewalls and cloud network controls | D3-RAM | Deny by default between zones, named source groups for administration | Rule hits and denies with source identity where available |
Product categories are examples, not recommendations. For the rollout of NAC itself use the Network access control (NAC) rollout playbook; for remote access see the Secure Remote Access Beyond VPN Guide.
Where identity fits
Network mediation is an identity decision made at the network edge, and it is often made about non-human subjects: printers and cameras on MAC Authentication Bypass, servers holding device certificates, CI runners and backup appliances holding VPN profiles, and site-to-site tunnels authenticated by a pre-shared key that nobody owns. Each of these is a credential. Give each one an owner, prefer certificates with an expiry over shared keys, and review them like accounts. The Colonial Pipeline ransomware attack began with a legacy VPN account that was no longer in use but had never been disabled, whose password appeared in a leaked credential set, on a VPN without MFA: the network gate worked exactly as configured. See the Orphaned and Dormant Accounts guide.
Implementation steps
- Inventory network entry points. List every way onto each network: switch ports, wireless SSIDs, VPN and ZTNA gateways, site-to-site tunnels, partner links, out-of-band management. Record the identity store each trusts and who owns it.
- Define who may join which segment. Write the role-to-segment map (staff, servers, OT, guests, contractors, unmanaged devices) before configuring anything. This is policy (D3FEND's Access Policy Administration); D3-NAM enforces it.
- Run in monitor mode. 802.1X monitor or open mode, VPN policies in log-only, and firewall rules in logging mode show who would be rejected. Collect at least two business cycles.
- Enforce in rings. Start with one site or one user group, then high-value zones such as administration networks. Keep a tested rollback per ring (switch a port group back to monitor mode, revert a rule set) and a named owner who can apply it out of hours.
- Add time limits. Set reauthentication periods for LAN sessions, maximum VPN session lengths, and expiry on contractor and partner access, in line with D3-AMED's scoped-duration expectation.
- Tie admission to account state. Make sure disabling an account or revoking a device certificate ends network access at the next reauthentication, and that dormant remote access accounts are disabled automatically.
How to verify it works
- Unknown device test: connect an unmanaged laptop to a production port and an internal SSID. Expect a reject or the quarantine VLAN, and a log line naming the port and MAC address.
- Disabled identity test: disable a test account or revoke a test device certificate, then confirm the VPN and 802.1X refuse it at the next authentication or reauthentication.
- Segment reach test: from each admitted role, attempt to reach administrative ports in other zones. Only the paths in the role-to-segment map should succeed.
- Bypass list review: compare the MAC Authentication Bypass list and any static port exceptions with the asset inventory; every entry needs an owner and a device that still exists.
- Log path check: confirm RADIUS, NAC, VPN and firewall decisions arrive in the SIEM with user or device identity, not only IP address. See the VPN and Firewall Log Detection Guide.
| Metric (example, not a standard) | What it shows | Direction |
|---|---|---|
| Share of switch ports and SSIDs in enforce mode | Real coverage of LAN mediation | Rising toward 100% for production |
| Devices admitted by MAC Authentication Bypass, with and without an owner | Size of the weakest admission path | Falling; every entry owned |
| Remote access accounts with no sign-in for 90 days | Dormant credentials that still pass the gate | Zero; disabled automatically |
| Remote access sessions without MFA | Unprotected network entry | Zero |
| Rejects and quarantines reviewed per week | Whether denials are being used as signal | All high-value zone denials triaged |
Limits, bypasses and failure patterns
- Valid credentials pass: network mediation authenticates; it cannot tell a legitimate user from an attacker holding the same password and device. Pair it with MFA and sign-in analytics. See the D3-MFA Multi-factor Authentication card.
- MAC Authentication Bypass is weak identity: a MAC address is an identifier, not a secret, so a device on a bypass list can be impersonated by anything that copies its address. Keep bypass ports in restrictive segments.
- Flat networks after admission: once inside, D3-NAM does nothing about east-west movement within the same segment. That is segmentation and resource mediation; see the Network Segmentation Guide.
- The gateway itself: a vulnerable VPN appliance can hand out sessions or credentials regardless of policy. Patch it as a tier-0 system and see the VPN Security Guide.
- Standing tunnels and shared keys: site-to-site and partner tunnels authenticated by long-lived pre-shared keys bypass per-user mediation entirely.
- Monitor mode forever: many 802.1X rollouts never leave monitor mode, so the logs look healthy while nothing is blocked. Track the enforce ratio.
Framework mapping
| Framework | Reference | Relationship to D3-NAM |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-17 Remote Access, AC-17(3) Managed Access Control Points | Remote access authorised and routed through managed points |
| NIST SP 800-53 Rev 5 | AC-18 Wireless Access, IA-3 Device Identification and Authentication | Wireless and device admission (D3-LAMED) |
| NIST SP 800-53 Rev 5 | SC-7 Boundary Protection, SC-7(5) Deny by Default, Allow by Exception | Zone boundaries and routing mediation (D3-RAM) |
| NIST CSF 2.0 | PR.IR-01, PR.AA-03 | Networks protected from unauthorised logical access; users, services and hardware authenticated |
| NIST SP 800-207 | Zero trust tenets | No implicit trust from network location; authenticate before session |
| MITRE ATT&CK | M1035, M1030 | Closest mitigations in intent (NHI Mgmt Group mapping, not D3FEND) |
The 800-53 and CSF rows are NHI Mgmt Group's mapping by control intent.
Related countermeasures
- Siblings under Access Mediation: Network Resource Access Mediation mediates what an admitted subject can do on a service. See the D3-NRAM Network Resource Access Mediation card.
- Authentication that feeds the decision: certificate-based authentication for devices and multi-factor authentication for people. See the D3-CBAN Certificate-based Authentication card.
- Detection beside mediation: remote access logins can be watched for unusual geography and session length. See the D3-UGLPA User Geolocation Logon Pattern Analysis card.
Practitioner checklist
- List every network entry point with its identity store and owner, including partner tunnels and out-of-band management.
- Write the role-to-segment map before configuring enforcement.
- Use certificate-based 802.1X for managed devices and keep MAC Authentication Bypass ports in restricted segments.
- Require MFA on every remote access path and disable dormant remote access accounts automatically.
- Set reauthentication and maximum session times so revocation takes effect.
- Move port groups and VPN policies from monitor to enforce in rings, with a tested rollback.
- Send admission, rejection and session logs with identity to the SIEM and review denials from high-value zones.
- Do not report D3-NAM as covering ATT&CK techniques; test it against the entry techniques it narrows instead.
Standards and references
- MITRE D3FEND: Network Access Mediation (D3-NAM)
- MITRE D3FEND: Access Mediation (D3-AMED)
- IETF: RFC 3580 IEEE 802.1X RADIUS Usage Guidelines
- NIST: SP 800-207 Zero Trust Architecture
- NIST: SP 800-46 Rev. 2 Guide to Enterprise Telework, Remote Access, and BYOD Security
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: MITRE D3FEND Access Mediation Implementation Guide · Network Access Control (NAC) Guide · ZTNA Guide · MITRE D3FEND Guide