5.5 Network Components: NAC, IDS/IPS, Firewalls, and Endpoints

Component roles and control objectives

A firewall filters traffic based on policy. A traditional stateful firewall tracks sessions and allows return traffic for approved flows. A next-generation firewall may add application awareness, user awareness, intrusion prevention, URL filtering, malware inspection, and TLS inspection. A web application firewall focuses on HTTP and API traffic patterns. A proxy intermediates client requests and can enforce egress policy. A load balancer distributes traffic and may terminate TLS. None of these controls is the whole security program.

NAC, or network access control, governs devices before or when they attach to the network. It may use 802.1X, certificates, device posture, MAC authentication bypass for constrained devices, guest registration, and dynamic VLAN assignment. NAC can reduce unauthorized access, but poor implementation can disrupt operations. Printers, cameras, medical devices, industrial systems, and emergency devices often need exception processes. Exceptions should be documented, segmented, and reviewed.

IDS and IPS controls compare traffic or behavior to signatures, heuristics, protocol rules, or anomaly baselines. IDS detects and alerts; IPS can block or modify traffic inline. The business tradeoff is false positive tolerance. A blocking IPS in front of a revenue service can reduce exploit risk but can also create outages if tuned poorly. Detection-only placement may be safer during early deployment but requires response capacity.

Placement, drift, and endpoints

Control placement follows traffic flow and business criticality. Internet-facing applications need edge filtering, DDoS planning, WAF or API protection where appropriate, secure load balancing, and backend segmentation. East-west data center traffic may need internal firewalls, microsegmentation, or host controls. Management traffic should use separate paths, bastion access, privileged access management, and strong logging. Egress traffic should be controlled because compromised systems often call out to command infrastructure or unsanctioned storage.

Rule drift is a common long-term failure. Emergency changes, temporary partner access, broad any rules, and undocumented migrations accumulate until policy no longer matches the risk model. Mature firewall governance includes request justification, owner, source, destination, service, expiration, testing, recertification, and removal. A rule that nobody owns is a business risk because nobody can explain the consequence of keeping or deleting it.

Endpoint controls matter because the network often sees traffic from trusted addresses. EDR, host firewalls, secure configuration, patching, application control, disk encryption, and local privilege management reduce the chance that a permitted flow is abused. If a user workstation is allowed to reach a file share, endpoint compromise can still become data theft. If a server is allowed to reach a database, server compromise can still become data manipulation. Defense in depth assumes permitted paths can be misused.

Firewall and detection governance workflow:

1. Define the application owner, data classification, allowed users, and required flows.
2. Place controls at ingress, egress, management, and lateral movement points based on the threat model.
3. Start with least privilege rules and document temporary exceptions with end dates.
4. Tune IDS and IPS alerts using business impact and incident response capacity.
5. Review rules, blocked traffic, allowed anomalies, and endpoint telemetry on a recurring schedule.
6. Test fail-open and fail-closed behavior so availability decisions are explicit.

A CISSP-level decision does not ask whether a firewall is good or bad in isolation. It asks what risk the component reduces, what risk it introduces, what team owns it, how it is monitored, and how it behaves under failure. The answer should connect technical placement to business outcomes such as fraud prevention, patient care continuity, manufacturing uptime, customer privacy, and regulatory evidence.