5.5Components of network security design

Enterprise security design works not through a single all-purpose appliance but by layering mechanisms with different roles. Stopping suspicious traffic at the boundary, assuring the health of the endpoint itself, blocking lateral movement inside the network, and preventing eavesdropping on a link are four different jobs. Rather than definitions, ENCOR asks which mechanism fits a requirement—for example, blocking inter-department traffic without changing the IP addressing plan, or preventing eavesdropping between adjacent switches.

5.5.1Threat defense and endpoint security

• Threat defense combines an IPS that detects known attack signatures and blocks them inline, a sandbox that detonates unknown samples in an isolated environment and judges them by behavior, and reputation filtering driven by external threat intelligence (such as Talos data). The distinction that an IDS only detects/alerts and does not block is asked repeatedly.
• Endpoint security defends the device itself. Alongside traditional signature-based protection, EDR (Endpoint Detection and Response) provides behavioral recording, retrospective hunting, and isolation. Posture assessment (integrated with ISE) checks OS patch level and anti-malware status at network admission and quarantines non-compliant endpoints into a remediation VLAN.
• A next-generation firewall (NGFW) goes beyond ports and protocols to perform application identification (distinguishing different applications riding the same port 443) and user identification (controlling by "who" via identity integration), while embedding IPS and URL filtering. The point is that it closes the traditional firewall's gap where permitting HTTPS effectively permits every application.

5.5.2TrustSec (group-based control with SGTs)

• TrustSec assigns a Security Group Tag (SGT) to a device or user at authentication and lets you write policy by group rather than by IP address or subnet. Policies are expressed as SGACLs in a matrix (source SG by destination SG) and managed centrally by ISE. Its greatest value is decoupling the addressing plan from policy.
• In traditional ACL-based design, every new department meant re-cutting subnets, ever-growing ACL entries, and chasing ACL updates across all devices on every move or hire. With TrustSec, the same policy applies wherever the endpoint sits, as long as its SGT is the same, which directly satisfies requirements such as blocking inter-department traffic without changing the IP plan. The same SGT is used in the policy layer of SD-Access.
• SGTs are assigned in conjunction with authentication (802.1X/RADIUS) and propagated between devices via inline tagging or SXP. Operationally, the correctness of policy depends on correct classification of who belongs to which group, so identity integration and group design are the heart of the implementation.

5.5.3MACsec (hop-by-hop encryption per 802.1AE)

• MACsec (IEEE 802.1AE) encrypts L2 Ethernet frames and is applied hop by hop (per link). It ensures confidentiality and integrity on the link between adjacent nodes—switch to switch, or host to access switch—defending against cable taps and wiretapping. Key management is handled by MKA (MACsec Key Agreement).
• The difference from IPsec is frequently tested: IPsec encrypts packets end to end at L3 (or gateway to gateway), protecting them across intervening routers. MACsec is decrypted at each hop and re-encrypted for the next, so it is not end-to-end confidentiality across an entire path. For encrypting site-to-site traffic over a WAN, IPsec fits; for preventing eavesdropping between adjacent campus switches, MACsec fits.
• Note that TrustSec and MACsec have different roles. TrustSec is access control—who may talk to whom—while MACsec is confidentiality—whether the wire can be read—and neither substitutes for the other. Real designs use both, protecting SGT-permitted traffic with MACsec.

Suppose a manufacturing campus refresh must satisfy three requirements at once. (1) Block traffic from finance-department endpoints to R&D servers—but departments are mixed across every floor, and re-cutting subnets is operationally infeasible. (2) Prevent eavesdropping on switch-to-switch links that run through inter-building conduits. (3) Keep personal devices that are missing patches off the business network. Solving (1) with traditional ACLs fails first: because departments do not align with subnets, you would end up writing host ACLs per endpoint, with every desk move requiring updates across all devices. This is where TrustSec belongs: assign SGT=Finance to finance endpoints and SGT=RnD-Server to the R&D servers at 802.1X authentication, then deny Finance to RnD-Server in the SGACL matrix, and the policy follows the endpoint regardless of subnet or floor. Not touching the IP design is the decisive advantage. Requirement (2) is about encryption, but reaching for IPsec tunnels between switches is a poor fit; what is asked for is protection of the physical link between adjacent nodes, so enabling MACsec (802.1AE) on those links with MKA key management is appropriate. MACsec is decrypted and re-encrypted at each hop, so it does not provide end-to-end secrecy—but it matches the stated requirement of defending against a tap inside the conduit exactly. Conversely, protecting site-to-site traffic across a WAN calls for IPsec rather than MACsec: which segment you want to protect determines the protocol. Finally, (3) concerns endpoint health, so neither TrustSec nor MACsec applies; posture assessment with ISE does, quarantining endpoints that fail patch or anti-malware criteria into a remediation VLAN until they comply. Concluding that "a stronger NGFW solves everything" is the classic error—an NGFW excels at boundary application/user identification and threat defense, but it cannot stop intra-campus lateral movement at SGT granularity, cannot prevent eavesdropping on a link, and cannot assure endpoint health. The core of the design judgment is identifying what each requirement protects (a conversation between groups, a wire, or the state of an endpoint) and layering the matching mechanism.

5.5.4Section summary

• Threat defense combines an IPS (inline blocking; an IDS only detects), sandboxing, and threat intelligence, while an NGFW guards the boundary by integrating application/user identification with IPS
• TrustSec writes group-based policy (SGACLs) with SGTs, decoupled from the IP addressing plan, to limit lateral movement. Endpoint security (EDR, posture assessment) assures endpoint health and quarantines non-compliant devices
• MACsec (802.1AE) provides hop-by-hop L2 encryption (decrypted and re-encrypted at each hop) against link tapping, while end-to-end encryption across hops is IPsec at L3—choose by the segment you must protect