I blogged on the ideas here at the En Garde blog at blog.consentry.com, but just wanted to quickly comment that NAC, in a fuller form, can do much more to help VoIP then just incidentally protect it from viruses. If true Network ACCESS Control is implemented vs. just simple admission control where endpoints are scanned, then a NAC system can also control what devices are allowed to communicate with the VoIP elements. So you could create a policy that says only VoIP phones can communicate with the call manager and vice-versa, providing a much greater form of protection against attack than simply blocking worms by checking endpoints.

Michelle McLean
ConSentry Networks
mmclean-at-consentry-com