6.4 Network & Endpoint Protection, Defense in Depth & Acceptable Use

Network & Endpoint Protection, Defense in Depth & Acceptable Use

Quick Answer: This section works the blueprint's Mitigation topic end to end. Identify ways to protect networks and devices used for remote access — isolation and segmentation, VPN, wireless network security, endpoint security, system hardening, intrusion prevention and detection. Explain layered security and defense-in-depth. Define least privilege, zero trust, whitelisting and need-to-know. Determine the appropriate preventive, detective and corrective controls. And recall the purpose and content of a technology acceptable use policy, including mobile and bring-your-own-device considerations.

---

1. Protecting Networks and Remotely Accessed Devices

Isolation and Segmentation

Divide the network so that compromising one zone does not deliver the next. Virtual LANs and firewall rules separate zones; microsegmentation isolates individual workloads inside a subnet. The control objective is to make lateral movement expensive. A flat network is the single condition that converts a minor endpoint infection into an enterprise ransomware event.

Virtual Private Network (VPN)

An encrypted tunnel that lets a remote endpoint participate in the corporate network across an untrusted one. Section 6.3 covers the protocol mechanics — IPsec tunnel and transport modes, AH versus ESP, and SSL/TLS VPNs — along with microsegmentation and the zero-trust control plane. Two design decisions matter for audit here:

• Split tunneling versus full tunneling. Split tunneling sends only corporate-destined traffic through the tunnel and lets everything else go direct, which preserves bandwidth but removes corporate inspection from the user's general internet traffic. Full tunneling routes everything through the enterprise for inspection at the cost of capacity.
• Access breadth. A traditional IPsec VPN grants broad subnet access, which is exactly the property zero-trust network access was invented to eliminate by brokering access to one named application at a time. VPN access must require multi-factor authentication; a VPN protected only by a password is a single stolen credential away from an internal foothold.

Wireless Network Security

Endpoint Security

• Endpoint protection platform (EPP) — signature and heuristic prevention of known malware.
• Endpoint detection and response (EDR) — behavioral telemetry, detection of suspicious sequences, and the ability to isolate a host from the network remotely. EDR is what detects an attack that uses only legitimate tools and therefore has no signature.
• Extended detection and response (XDR) — correlation of endpoint, identity, email and network telemetry into a single detection pipeline.
• Supporting controls: host-based firewall, full-disk encryption, removable-media control, and application control.

System Hardening

Reduce the attack surface to the minimum the system needs to do its job:

• Remove or disable unnecessary services, protocols, ports, and sample applications.
• Change every default credential and remove default and guest accounts.
• Apply a recognized configuration baseline — CIS Benchmarks or DISA STIGs — rather than an internally invented one.
• Build from a hardened golden image so every new system starts compliant.
• Detect configuration drift continuously and alert on deviation from baseline.

Intrusion Detection and Prevention

The audit question is never "do you have an IPS." It is whether the IPS is in blocking mode or has been quietly left in alert-only mode, and whether anyone reviews and tunes the alerts.

---

2. Layered Security and Defense-in-Depth

Defense-in-depth is the principle that security must not depend on any single control. Multiple independent controls are placed in sequence so that the failure of one does not produce a breach. Layered security is the same idea expressed architecturally — controls arranged in concentric layers around the asset.

The property that makes this work is independence. Two controls that fail for the same reason are one control. A firewall and an IPS from the same vendor sharing the same vulnerable inspection engine provide one layer, not two — which is why dual-firewall DMZ designs traditionally use two different vendors. This is sometimes called diversity of defense.

   People & Policy      Awareness training, acceptable use policy, background checks
        |
   Physical             Facility access control, visitor management, media handling
        |
   Perimeter            Firewalls, DMZ, IPS, DDoS scrubbing, email and web gateways
        |
   Network              Segmentation, microsegmentation, network access control, monitoring
        |
   Endpoint             Hardening, patching, EDR, disk encryption, device control
        |
   Application          Secure coding, input validation, web application firewall
        |
   Identity             MFA, least privilege, privileged access management, access reviews
        |
   Data                 Classification, encryption at rest and in transit, DLP, tokenization
        |
   Detect & Recover     Logging and SIEM, incident response, immutable backups

A useful exam heuristic: for any scenario asking "what additional control," look for the layer that is missing rather than for a stronger version of a layer that already exists.

---

3. Four Definitions the Blueprint Asks For

The blueprint task is literally "define the concepts of least-privilege, zero-trust, whitelisting and the need-to-know principle." Keep them distinct.

Two distinctions the exam exploits:

• Least privilege versus need-to-know. Two analysts in the same role hold identical privileges under least privilege. Need-to-know still prevents the analyst working on Division A from opening Division B's merger file. Least privilege is about capability; need-to-know is about scope of information.
• Whitelisting versus blacklisting. A blocklist denies known-bad and permits everything else, so it fails open against anything new. An allowlist permits known-good and denies everything else, so it fails closed. Allowlisting is far stronger and far more operationally demanding, which is why it is applied first to servers and fixed-function systems rather than to general-purpose user workstations.

---

4. Classifying Controls: Preventive, Detective, Corrective

The blueprint asks candidates to "determine the common preventive, detective or corrective controls (e.g., intrusion prevention systems, device and software hardening, log analysis, intrusion detection systems, virus quarantining, patches) to mitigate risk of cyber-attacks."

Three cautions:

1. The same technology can occupy different classes depending on configuration. An IDS is detective; the same appliance placed inline in blocking mode is preventive. A patch applied on schedule is preventive; the same patch applied after an incident is corrective.
2. Deterrent and compensating are related but distinct. A warning banner or visible camera is deterrent. A control that addresses a risk when the primary control cannot operate — a detailed independent reconciliation where segregation of duties is impossible in a small department — is compensating.
3. A control set weighted entirely toward prevention is fragile. Prevention fails eventually; without detection you do not learn that it failed, and without correction you cannot recover. Exam scenarios often describe a heavily fortified perimeter with no monitoring and no tested backups.

---

5. The Technology Acceptable Use Policy

The blueprint asks candidates to "recall the purpose and content of a technology acceptable use policy including considerations specific to mobile technologies and bring-your-own-device (BYOD)."

Purpose. To define, in a document each user signs, what constitutes authorized use of the organization's information technology; to set the expectation that activity on corporate systems is monitored and carries no expectation of privacy; and to establish the disciplinary basis for enforcement. Without a signed acceptable use policy, monitoring may be legally contestable and termination for misuse is difficult to defend.

Content it should contain:

• Scope. Which systems, accounts, networks, devices and data the policy covers, and who it binds — employees, contractors, temporary staff, interns, third parties.
• Permitted and prohibited use. Business use; the limits of incidental personal use; explicit prohibitions on unauthorized software installation, circumventing security controls, sharing credentials, unauthorized data transfer, and unlawful or harassing content.
• Monitoring and no expectation of privacy. A clear statement that email, internet activity, file access and system use may be logged, inspected and reviewed.
• Data handling. How classified data may be stored, transmitted, printed and disposed of; restrictions on removable media, personal cloud storage and personal email.
• Account and credential responsibility. No sharing, no writing down, mandatory MFA enrollment, immediate reporting of suspected compromise.
• Software and licensing. Only approved software from approved sources; no unlicensed copies.
• Incident reporting. Who to contact and how fast, with an explicit non-retaliation statement so that clicking a phishing link is reported rather than hidden.
• Consequences. Progressive discipline through termination, and referral where conduct is unlawful.
• Acknowledgment. Dated signature at onboarding and re-acknowledgment on a defined cycle, with completion tracked and reconciled to the HR roster.

Mobile-specific provisions. Encryption and screen-lock requirements; minimum operating system version; prohibition on jailbreaking or rooting; application installation restrictions; requirements for connecting over public Wi-Fi; and immediate loss or theft reporting.

BYOD-specific provisions. These carry the most legal weight and the most exam value:

• Consent to management. The user consents to enrollment in mobile device management or mobile application management as a condition of access.
• Selective wipe consent. The organization may remove corporate data — and the user acknowledges that a full wipe may be necessary in defined circumstances, such as loss of a device without containerization.
• The privacy boundary. State explicitly what the organization can and cannot see on a personal device. Ambiguity here is the single most common cause of BYOD program failure.
• Legal hold and discovery. The user acknowledges that corporate data on a personal device may be subject to litigation hold and production.
• Support, cost and separation. Who pays for the device and service, what support is provided, and what happens to corporate data on the last day of employment.