If a rogue user has access to a valid username/password its a challenge to detect this. You could use
- RSA tokens, probably the easiest method from ACS perspective... no passwords to steal and requires a PIN.
- NARs. Painful but if you knew the mac address(es) each user might use its possible to catch stolen credentials
- NAC, If valid users have a NAC aware client, ACS can interrogate the registry on the client to check for known keys/values
Neither 2 or 3 would handle a stolen laptop. No easy answers here Im afraid. The question is really "how would you determine if someone on the network was legit" - if you cant tell, ACS will not be able to either.
FWIW the advanced filtering on the NAP page is more intended as a method by which the desired network service can be determined, and therefore handled by the appropriate policy (WLAN, VPN, etc).
