Cell Phone Detection & Network Access Control (NAC)

This demo shows Bastille’s integration with Aruba ClearPass performing zone-based network access control triggered by an unauthorized cell phone. The presenter carries a T-Mobile phone into a zoned office while on a live video call. The moment the phone crosses into the zone, Bastille detects it and signals ClearPass via API, which immediately cuts network access for every device in that space, including a wired corporate desktop, whose conference call drops mid-session. The demo is shown unedited, with the phone’s position visible on both the live interface and the camera view. A parallel customer use case adds a strobe light via Bastille’s Lenel integration, giving a visible physical alert alongside the network shutdown.

Why It Matters

Standard NAC assumes you can reach the device: an agent, a corporate connection, some point of control. An unauthorized phone on a cellular network offers none of that, which leaves a real gap in SCIFs, boardrooms, and other sensitive spaces. This flips the enforcement model: instead of controlling the untrusted device, you shut down the trusted environment around it. RF detection becomes the trigger for existing network and physical security infrastructure, so the response is automatic rather than dependent on someone noticing a policy violation. For wireless security teams, it’s a practical answer to the “we ban phones but can’t enforce it” problem, and a reminder that RF visibility is only useful when it’s wired into systems that can actually act on it.

Transcript

I’m going to show you a demo now using a phone. It’s the same sort of demo I showed before with Aruba ClearPass, where I did network access control on a corporate-connected laptop.

With phones, you can’t really use that paradigm. The corporate network security team has no access to the phone — especially if it’s an unauthorized phone. It’s on a cellular network, and there’s no agent on it. So what can you do?

One thing several of our customers have come up with is this: if a phone enters a restricted area, first, turn on a strobe light. Second, cut off network access for every device in that space.

So there’s a rogue phone in the space that I don’t trust. Shut everything down, turn on the strobe light, and hold until we can sort out what happened in that room, clear it, and then continue our sensitive conversations.

I don’t have a strobe light in this demo, but we do have customers and demo facilities where the strobe light is part of the equation. People use systems like Lenel to connect the strobe light to Bastille — Bastille has a Lenel integration. Lenel is a physical security system that manages badge readers, alarms, and so on.

In this demo, I’m going to show you the Aruba ClearPass portion, where we NAC an entire zone of devices when a cell phone enters that zone.

On the left, you’re seeing the camera view from the phone I’m carrying. I’m about to enter this office, which is zoned out in our interface. I’m also on a video conference call, live — so none of this is faked. You can see the dot appear on both the live screen and my screenshot.

On the right, you can see the conference call I was on, now complaining that I’ve lost my network connection. It’s the same setup we saw before: this wired desktop computer on the corporate network has lost its connection.

The reason it lost the connection is that my T-Mobile phone entered the zone. The API between Bastille and ClearPass communicated, ClearPass received a signal from Bastille that the zone needs to be NAC’d, and it cut off network access for every device in that zone.

That’s a pretty exciting integration, and a few of our customers are using it today.

Key Takeaways

• Cell phones cannot be controlled through normal network access control because unauthorized phones run on cellular with no corporate agent
• Bastille detects a phone the moment it crosses into a zoned area and signals the access-control system via API
• In the demo, an unauthorized phone entering the zone triggers ClearPass to cut network access for every device in that space
• Integrations with Lenel and similar systems can add physical responses like strobe lights to a wireless detection

Video Transcript

So I'm going to show you a demo now where I've got a phone. It's the same sort of demo I showed before with Aruba ClearPass, where I did network access control of a corporate-connected laptop. For phones, that you can't really use that paradigm because the phone and especially if it's an unauthorized phone, the corporate network security folks have no access to that phone. It's on a cellular network, and there's no agent because it's an unauthorized phone. So what can you do?

Well, one thing that our customers have come up with, several customers have said, what I'd like to do is if a phone goes into this restricted area, first of all, I want to turn on a strobe light. And second of all, I'd like to cut off access to any network device in that space. So this rogue phone that I don't trust is in the space. Let's just shut everything down and turn on a strobe light until we can sort out what happened in that room, clear the room, and then continue our sensitive conversations.

So in the demo, I don't have the strobe light, but we do have customers. We do have demos, facilities where the strobe light is part of the equation. And people use systems like Lenel to connect the strobe light to Bastille. So Bastille's got a Lenel integration. Lenel's a physical security kind of system that manages all your physical security, your badge readers, and alarms, and whatnot. And so people have used Lenel to hook up strobe lights.

In this demo, I'm going to show you the, again, it's Aruba ClearPass portion of this, where we're going to NAC an entire zone of devices when a cell phone comes into the zone. So you're seeing on the left, the view from the camera of the phone that I'm carrying. And I'm about to enter this office, which is zoned out in our interface. And when I do, I'm going to show you again, I'm in a video conference call, you can see live. So none of this is faked. You can see the dot on both the live screen and my screenshot.

On the right there, you can see that I was in a conference call, and my conference call is now complaining that I've lost my network connection. So it's the same setup that we saw before. This wired desktop computer that's on the corporate network has lost its network connection. And the reason it's lost the network connection is because my T-Mobile phone has gone into this zone. And then the API between Bastille and ClearPass have communicated. And ClearPass has gotten a signal from Bastille that says this zone needs to be NAC.

And it's cut off network access for every device in that zone. So that's a pretty exciting integration that a few of our customers are using.