5.5Components of network security design

Enterprise security design works not through a single all-purpose appliance but by layering mechanisms with different roles. Stopping suspicious traffic at the boundary, assuring the health of the endpoint itself, blocking lateral movement inside the network, and preventing eavesdropping on a link are four different jobs. Rather than definitions, ENCOR asks which mechanism fits a requirement—for example, blocking inter-department traffic without changing the IP addressing plan, or preventing eavesdropping between adjacent switches.

5.5.1Threat defense and endpoint security

• Threat defense combines an IPS that detects known attack signatures and blocks them inline, a sandbox that detonates unknown samples in an isolated environment and judges them by behavior, and reputation filtering driven by external threat intelligence (such as Talos data). The distinction that an IDS only detects/alerts and does not block is asked repeatedly.
• Endpoint security defends the device itself. Alongside traditional signature-based protection, EDR (Endpoint Detection and Response) provides behavioral recording, retrospective hunting, and isolation. Posture assessment (integrated with ISE) checks OS patch level and anti-malware status at network admission and quarantines non-compliant endpoints into a remediation VLAN.
• A next-generation firewall (NGFW) goes beyond ports and protocols to perform application identification (distinguishing different applications riding the same port 443) and user identification (controlling by "who" via identity integration), while embedding IPS and URL filtering. The point is that it closes the traditional firewall's gap where permitting HTTPS effectively permits every application.