Network, Endpoint and Infrastructure Defence

Introduction

Cybersecurity defence is not achieved by installing a single security product. It is an engineered system of preventive, detective, corrective and governance controls distributed across networks, endpoints, applications, identities and infrastructure. Network controls regulate communication; endpoint controls protect devices and processes; infrastructure controls reduce exploitable weaknesses in servers, cloud platforms, wireless systems and management interfaces.

This chapter examines how these controls are designed, configured and assessed. It treats security tools as components of a defence architecture rather than isolated technologies. A firewall may restrict traffic, but it cannot determine whether an authorised user is misusing a valid account. An endpoint detection and response (EDR) platform may identify suspicious behaviour, but it is less effective when operating systems are unpatched or logs are unavailable. Effective defence therefore depends on layered controls, secure configuration, continuous monitoring and an informed response process.

Learning Objectives

By the end of this chapter, students should be able to:

• explain the roles and limitations of firewalls, IDS, IPS, EDR and anti-malware;
• design network segmentation and secure wireless architectures;
• compare VPN technologies and configure secure remote access principles;
• apply hardening, patching and secure-baseline practices;
• assess defensive controls using appropriate technical and operational evidence;
• analyse a realistic infrastructure-defence problem and recommend proportionate improvements;
• identify governance, privacy, legal and ethical considerations in defensive monitoring.

1. Defence as a Layered Architecture

A useful defensive architecture combines four control functions:

Defence in depth is not simply the presence of multiple tools. The layers must be independent enough that failure of one does not automatically defeat the others. For example, a firewall should not be the only control separating a public web server from a database. Network segmentation, restrictive host firewalls, strong authentication, application authorisation and database monitoring should provide additional barriers.

A defensive design begins with assets, trust boundaries and business flows. Administrators should identify what must communicate, who may initiate communication, what data is involved, and how the communication will be monitored. A rule that is technically secure but prevents a critical clinical, manufacturing or financial process may create operational risk. Conversely, a rule created for convenience may expose sensitive systems.

2. Firewalls and Traffic Control

A firewall enforces a traffic policy between network zones. It may operate at several layers:

• Packet-filtering firewall: evaluates addresses, protocols and ports.
• Stateful firewall: tracks connection state and permits packets that belong to an established session.
• Next-generation firewall (NGFW): may add application identification, user context, TLS inspection and integrated threat prevention.
• Web application firewall (WAF): examines HTTP or HTTPS requests for application-layer attacks such as injection and malicious request patterns.
• Host-based firewall: enforces traffic policy on an individual endpoint or server.
• Cloud firewall or security group: applies provider-defined controls to virtual resources and interfaces.

A firewall policy normally includes source, destination, service or port, direction, action, schedule and logging requirement. The principle of least privilege means that rules should permit only necessary communication. A secure default is usually “deny by default, allow by exception.” Rules should be ordered carefully because many systems evaluate them from top to bottom and stop at the first match.

A sound rule has a documented owner, business purpose, expiry or review date, and identifiable source and destination. Broad rules such as “any source to any destination, any service” are difficult to monitor and often conceal unnecessary exposure. Administrative interfaces should be restricted to management networks or privileged access workstations, rather than exposed to the internet.

Stateful inspection and address translation

A stateful firewall records connection information such as source and destination, protocol, ports and session state. This allows it to distinguish a reply to an internal request from an unsolicited inbound connection. Network address translation (NAT) changes address information as traffic crosses a boundary. NAT can reduce direct exposure of private addresses, but it is not a substitute for access control: an incorrectly configured NAT rule can still expose a service.

Firewall assessment

Configuration review should examine:

1. whether every rule has a business justification;
2. whether unused, duplicate and shadowed rules have been removed;
3. whether administrative access is restricted and strongly authenticated;
4. whether denied and high-risk permitted traffic is logged;
5. whether logs are time-synchronised, protected and reviewed;
6. whether rules are tested after change and periodically recertified;
7. whether emergency rules expire automatically.

Testing should include authorised vulnerability scanning, controlled connectivity tests and review of actual flows. A rule allowing TCP port 443 does not prove that the application behind it is secure; it proves only that a network path exists.

3. Intrusion Detection and Prevention

An intrusion detection system (IDS) observes activity and generates alerts. An intrusion prevention system (IPS) places detection in a position where it can block, reset or otherwise disrupt traffic. Both may use:

• Signature detection, which matches known patterns;
• Anomaly detection, which identifies deviation from a baseline;
• Protocol analysis, which detects malformed or abusive protocol behaviour;
• Behavioural or reputation intelligence, which uses contextual evidence about hosts, domains and actions.

Network IDS sensors may be deployed at internet gateways, between trust zones or near high-value systems. Host IDS tools inspect processes, files, logs and system calls. Detection quality depends on visibility, accurate time, correct sensor placement and well-maintained rules.

IPS introduces operational risk because a false positive may block legitimate business traffic. Prevention should therefore be introduced in stages: monitor-only mode, tuning, controlled blocking of high-confidence events, and periodic review. Critical traffic should have an approved exception process, not an informal bypass.

An alert is not an incident by itself. Analysts should validate the asset, user, process, time, related events and likely impact. Useful measures include alert volume, false-positive rate, mean time to acknowledge, mean time to contain and the proportion of high-severity alerts receiving documented disposition. These measures are meaningful only when definitions are consistent.

4. Secure Wireless Networks

Wireless networks extend the organisation’s trust boundary beyond physical cable. A secure design separates corporate, guest, operational technology and personal-device traffic. Recommended controls include:

• WPA3-Enterprise where supported, or WPA2-Enterprise with a strong, centrally managed authentication service;
• 802.1X authentication using an enterprise identity service;
• certificate validation and protection against rogue access points;
• separate guest networks with internet-only access;
• management-plane protection and changed default credentials;
• central logging, configuration management and firmware maintenance;
• radio-frequency surveys and detection of unauthorised access points;
• disabling obsolete protocols and weak shared keys.

A pre-shared key may be appropriate for a small, low-risk environment, but a single shared key creates accountability and rotation problems. Enterprise authentication permits individual identity, revocation and better auditability. Wireless encryption protects the radio link; it does not authorise access to every internal service. VLANs, firewall policy and identity-aware controls remain necessary.

5. Virtual Private Networks and Secure Remote Access

A virtual private network (VPN) creates an authenticated and cryptographically protected tunnel over an untrusted network. Common models include:

• Remote-access VPN: connects an individual device to organisational services;
• Site-to-site VPN: connects two networks, often through IPsec gateways;
• Clientless or portal access: publishes selected applications through a controlled gateway;
• Zero-trust application access: grants access to specific applications based on identity, device posture and context rather than placing the device broadly on the network.

A secure VPN requires strong authentication, modern cryptographic protocols, certificate or key management, device posture checks, logging and timely software updates. MFA should be enforced, especially for privileged or sensitive access. Split tunnelling can improve performance but may allow a compromised endpoint to bridge local and corporate networks. Full tunnelling provides more central inspection but increases bandwidth and gateway requirements.

Remote access should follow least privilege. A contractor requiring access to a ticketing application should not receive unrestricted access to server subnets. Administrative access should use dedicated accounts, privileged access management, session recording where lawful and time-limited authorisation.

A VPN does not make an unmanaged device trustworthy. Endpoint compliance, malware protection, disk encryption, screen-lock controls and a supported operating system should be prerequisites for sensitive access. Access should be revoked promptly when employment, contracts or business requirements end.

6. Endpoint Detection and Response and Anti-Malware

Traditional anti-malware commonly uses signatures, reputation services, heuristics and behavioural blocking. These mechanisms remain valuable, particularly against known and common threats, but modern attacks may use legitimate administration tools, stolen credentials and previously unseen files. EDR extends protection by collecting endpoint telemetry such as process creation, command-line arguments, network connections, persistence mechanisms, file changes and user context.

EDR capabilities commonly include:

• continuous telemetry and search;
• detection rules and behavioural analytics;
• process termination and file quarantine;
• host isolation from the network;
• remote investigation and response scripts;
• timeline reconstruction and evidence preservation.

EDR deployment must be governed carefully. Excessive telemetry can create privacy, storage and analyst-workload problems. Agents should be tested for performance and compatibility, especially on servers, industrial systems and specialised devices. Tamper protection should be enabled, but emergency recovery procedures must exist if an agent fails or blocks a critical process.

A useful endpoint response sequence is: validate the alert; identify the affected user, host and process; contain the host; preserve volatile and relevant evidence; remove persistence; reset exposed credentials; patch the cause; restore normal operation; and document lessons learned. Isolation is not always the first action: on a critical industrial controller, abrupt isolation could create safety or production consequences. The response must be risk-informed.

7. Hardening and Secure Baselines

Hardening reduces attack surface by removing unnecessary functionality and enforcing secure settings. A baseline should be defined for each platform, such as a workstation, domain controller, database server, cloud workload or network device. Common baseline elements include:

• supported operating system and firmware versions;
• removal or disabling of unused services, ports and accounts;
• secure authentication and lockout configuration;
• least-privilege permissions;
• host firewall rules;
• encryption at rest and in transit;
• secure logging and time synchronisation;
• application allow-listing where appropriate;
• restricted scripting and macro execution;
• backup and recovery configuration;
• protection of management interfaces.

Baselines should be expressed as testable requirements, not vague statements such as “configure securely.” Configuration management tools can compare systems with approved states and report drift. Exceptions should have a reason, owner, compensating control and review date.

Hardening must account for function. Disabling a service without understanding dependencies may interrupt operations. A controlled build process, test environment and rollback plan are therefore essential. Secure images and infrastructure-as-code can improve consistency, provided the code and image repositories are themselves protected.

8. Patch and Vulnerability Management

Patching is a lifecycle rather than a single installation event. It includes asset discovery, vulnerability intelligence, risk assessment, testing, deployment, verification and exception management. Priority should consider exploit availability, exposure, asset criticality, compensating controls and business impact—not merely a vendor score.

A practical patch process is:

1. maintain an accurate inventory of hardware, software, versions and owners;
2. identify relevant vulnerabilities from trusted advisories and scanning;
3. classify assets by business and safety impact;
4. test patches in representative environments;
5. deploy according to risk-based service levels;
6. verify installation and security effect;
7. monitor for instability or exploitation;
8. document exceptions and alternative controls.

Where immediate patching is impossible, controls may include removing internet exposure, disabling a vulnerable feature, restricting access, increasing monitoring, or applying a vendor mitigation. An exception is not a permanent acceptance of risk; it should be reviewed and retired.

Vulnerability scanners are useful but imperfect. They can miss assets, misidentify versions, fail to authenticate, or report a theoretical weakness that is not exploitable in the local configuration. Findings require validation and contextual analysis.

9. Segmentation and Infrastructure Defence

Segmentation limits lateral movement and reduces the blast radius of compromise. Logical segmentation may use VLANs, routing domains, firewalls, software-defined policy or identity-based access. Typical zones include internet-facing services, user endpoints, servers, databases, management systems, backups, guests and operational technology.

Segmentation is effective only when traffic between zones is explicitly controlled. Placing systems in different VLANs without an enforcing policy may provide little security. The architecture should identify permitted flows, prohibit unnecessary east-west communication and monitor attempts to cross boundaries.

A common pattern is a demilitarised zone (DMZ) for public services. Internet traffic reaches a controlled public tier; application services communicate with internal components through narrowly defined paths; databases are not directly exposed to the internet. Management traffic should use a separate administrative plane and should not share ordinary user credentials.

Infrastructure defence also includes secure DNS, protected identity services, resilient backups, secrets management, cloud control-plane security and physical safeguards. Backups should be isolated from ordinary administrator credentials, tested through restoration exercises and protected against ransomware alteration or deletion.

10. Assessment and Assurance

Assessment combines configuration evidence, technical testing and operational interviews. Important evidence includes firewall exports, wireless controller settings, VPN policies, endpoint coverage reports, patch compliance, vulnerability results, log samples, alert dispositions, backup restoration records and access reviews.

A mature assessment asks not only “Is the control enabled?” but also “Does it work under realistic conditions?” For example:

• Can an unauthorised device join the corporate wireless network?
• Does a revoked user lose VPN access promptly?
• Does EDR detect and contain a simulated malicious process?
• Can a segmented user network reach a database directly?
• Are critical patches installed within the organisation’s defined period?
• Can the organisation restore a clean system after destructive malware?

Control effectiveness should be evaluated against defined requirements and risk appetite. Metrics should support decisions rather than reward superficial compliance. High patch percentages can conceal unpatched internet-facing systems; low alert counts can indicate either good security or poor visibility.

Illustrative Case: Northbridge Health Services

Background

Northbridge Health Services is an illustrative regional healthcare provider with clinics, a central data centre, cloud applications, wireless medical devices and remote clinicians. Its network grew through acquisitions. A flat internal design allowed workstations, medical devices and administrative servers to communicate broadly. Remote access used a VPN with passwords and limited endpoint checks.

Problem

An attacker obtained a staff password through phishing. The account connected through the VPN, accessed a workstation, and used internal discovery to locate a file server containing patient-related documents. The organisation had anti-malware, but endpoint logging was incomplete and firewall rules had accumulated without owners. Guest wireless traffic was separated, but medical and corporate wireless networks were not consistently isolated.

Analysis

The principal weaknesses were not the absence of a single product. They were excessive trust, weak identity assurance, incomplete visibility, poor rule governance and insufficient recovery testing. The attacker’s path depended on valid credentials and permitted lateral movement. A signature-only approach was unlikely to identify every stage.

Approach and solution

Northbridge adopted a staged programme:

1. MFA and device-compliance checks were required for remote access.
2. Administrative access was moved to privileged workstations and separate accounts.
3. User, server, medical-device, guest and management zones were segmented.
4. Firewall rules were rewritten from documented business flows, with default denial between sensitive zones.
5. EDR was deployed to supported endpoints, with isolation procedures tested against clinical safety requirements.
6. Unsupported systems received compensating controls and replacement deadlines.
7. Wireless authentication moved toward individual enterprise identities, with certificates validated by managed clients.
8. Critical patches received accelerated treatment, while exceptions required executive risk acceptance.
9. Immutable or otherwise protected backups were introduced and restoration was rehearsed.
10. A tabletop exercise and authorised technical simulation tested the revised controls.

Outcome

The organisation reduced unnecessary lateral connectivity, improved attribution of remote access, and shortened investigation time. It did not claim that compromise was impossible. Instead, the architecture made credential misuse more difficult to extend, improved detection and created reliable recovery options.

Learning points

The case demonstrates that network, endpoint and infrastructure controls must be designed together. Segmentation without identity controls is incomplete; EDR without useful telemetry is weak; patching without asset inventory is unreliable; and secure remote access without device assurance can import risk directly into the internal environment.

11. Governance, Ethics and Contemporary Developments

Defensive monitoring may process usernames, communications metadata, command lines, location information or personal files. Organisations should define a lawful purpose, minimise collection, restrict access, set retention periods and communicate monitoring practices appropriately. Security teams must not use defensive authority for personal surveillance or unauthorised investigation. Penetration tests, malware simulations and scanning require written scope and permission.

Regulatory duties vary by jurisdiction and sector, but common expectations include protection of personal data, incident reporting, supplier oversight, records of processing, access control and demonstrable risk management. Healthcare, finance, education and critical infrastructure may have additional requirements.

Artificial intelligence is increasingly used for behavioural detection, alert correlation, malware classification and analyst assistance. It can improve scale, but it may generate false positives, reproduce biased assumptions, expose sensitive telemetry or produce explanations that analysts cannot verify. AI-generated response actions should be bounded by approvals, logging, rollback and human oversight. Automation is most trustworthy when its input quality, confidence thresholds and failure modes are understood.

Contemporary architectures increasingly combine zero-trust principles, cloud-native controls, identity-aware segmentation, software supply-chain security and continuous exposure management. These developments do not eliminate foundational practices. Strong identity, secure configuration, patching, logging, tested backups and disciplined change management remain essential.

Best-Practice Checklist

• Define assets, trust boundaries and required business flows.
• Deny unnecessary communication and document every exception.
• Separate users, servers, management, guests, backups and sensitive devices.
• Enforce MFA and device posture checks for remote and privileged access.
• Maintain secure, tested baselines and detect configuration drift.
• Inventory assets and prioritise patches using exposure and impact.
• Deploy EDR with tested isolation and evidence-preservation procedures.
• Protect logs, synchronise time and review high-value events.
• Test restoration, segmentation and incident response—not merely configuration.
• Govern monitoring, automation and exceptions through accountable processes.

Chapter Summary

Network, endpoint and infrastructure defence is a coordinated system of preventive, detective, corrective and governance controls. Firewalls regulate flows but require least-privilege rules, review and logging. IDS and IPS provide detection and prevention, although accuracy depends on visibility and tuning. Secure wireless networks require strong authentication, segmentation and management protection. VPNs provide protected transport but must be combined with MFA, device assurance and least-privilege application access.

EDR extends anti-malware through behavioural telemetry, investigation and response. Hardening and secure baselines reduce attack surface, while patch management depends on inventory, risk prioritisation, testing and verification. Segmentation limits lateral movement only when enforced by policy. Assessment must test real effectiveness, not merely the existence of settings. Finally, privacy, authorisation, legal duties and human oversight are essential when monitoring people and automating defensive decisions.

Key Terms

Firewall: A control that permits or blocks traffic according to policy.

Stateful inspection: Firewall processing that tracks the state of network connections.

Next-generation firewall: A firewall with capabilities such as application, identity and threat analysis.

DMZ: A controlled network zone for services exposed to less-trusted networks.

IDS: An intrusion detection system that identifies and reports suspicious activity.

IPS: An intrusion prevention system that can block or disrupt suspicious activity.

WAF: A web application firewall that filters application-layer web requests.

WPA3-Enterprise: A wireless security mode using enterprise authentication and modern protection.

802.1X: A port-based network access-control framework commonly used with enterprise wireless authentication.

VPN: An authenticated, encrypted tunnel across an untrusted network.

EDR: Endpoint detection and response technology providing endpoint telemetry and response actions.

Hardening: Reducing attack surface through secure configuration and removal of unnecessary functionality.

Secure baseline: An approved, testable configuration standard for a system or platform.

Patch management: The lifecycle of identifying, testing, deploying and verifying updates.

Segmentation: Dividing an environment into zones with controlled communication between them.

Lateral movement: An attacker’s movement from one compromised system or account to another.

MFA: Authentication requiring two or more independent factors.

Least privilege: Providing only the access necessary for an approved task.

Configuration drift: Unauthorised or unintended divergence from an approved baseline.

Zero trust: A security approach that continuously evaluates identity, device, context and requested resource rather than trusting network location.

Review Questions

Short Answer Questions

1. What is the difference between an IDS and an IPS?
2. Why is NAT not a substitute for firewall access control?
3. Identify three requirements for secure remote VPN access.
4. What is configuration drift, and how can it be detected?
5. Why should guest wireless traffic be separated from corporate traffic?

Long Answer Questions

1. Explain how firewalls, IDS/IPS and EDR contribute different layers of defence in depth.
2. Describe a risk-based patch-management lifecycle, including the treatment of exceptions.
3. Compare remote-access VPN, site-to-site VPN and zero-trust application access.
4. Design a segmented architecture for an organisation containing users, public servers, databases, management systems and guests.
5. Discuss the ethical, privacy and governance issues associated with endpoint monitoring and AI-assisted response.

Analytical / Application Questions

1. A company permits all internal workstations to reach every server, uses password-only VPN access and has incomplete endpoint coverage. Analyse the attack paths created by this design and recommend a prioritised improvement programme.
2. An IPS begins blocking legitimate clinical traffic after a new detection rule is enabled. Explain how the organisation should investigate, contain the risk and safely tune or roll back the rule.
3. A critical server cannot be patched for six weeks because of application compatibility. Develop a compensating-control plan and specify the evidence needed to justify continued operation.

Multiple Choice Questions with Answers

Question 1

Which firewall principle most directly expresses least privilege?

A. Permit all traffic and investigate after an incident

B. Deny unnecessary traffic and allow documented exceptions

C. Allow all traffic between internal VLANs

D. Disable logging to improve performance

Correct Answer: B. Deny unnecessary traffic and allow documented exceptions

Question 2

What is the primary additional capability provided by EDR compared with basic signature anti-malware?

A. Physical destruction of infected hardware

B. Continuous endpoint telemetry and response actions

C. Replacement of network segmentation

D. Guaranteed prevention of unknown attacks

Correct Answer: B. Continuous endpoint telemetry and response actions

Question 3

Which wireless design best supports individual accountability?

A. One shared password for all employees

B. An open network with hidden SSID

C. Enterprise authentication using 802.1X

D. A publicly published guest password

Correct Answer: C. Enterprise authentication using 802.1X

Question 4

What is a major risk of split tunnelling in a remote-access VPN?

A. It prevents all encryption

B. It may allow a compromised endpoint to bridge local and corporate networks

C. It eliminates the need for authentication

D. It makes certificate validation impossible

Correct Answer: B. It may allow a compromised endpoint to bridge local and corporate networks

Question 5

Which control most directly limits lateral movement?

A. Network segmentation with enforced inter-zone policy

B. Increasing monitor brightness

C. Using longer hostnames

D. Disabling time synchronisation

Correct Answer: A. Network segmentation with enforced inter-zone policy

Question 6

Why should an IPS normally be tuned before broad blocking is enabled?

A. To increase false positives

B. To reduce the risk of disrupting legitimate operations

C. To remove the need for incident response

D. To prevent all encrypted traffic

Correct Answer: B. To reduce the risk of disrupting legitimate operations

Question 7

Which statement about vulnerability-scanner results is most accurate?

A. Every finding is automatically exploitable

B. Scanners never miss assets

C. Findings require validation and business context

D. Scanning removes the need for patching

Correct Answer: C. Findings require validation and business context

Question 8

Which is the strongest example of a secure hardening practice?

A. Leaving unused services enabled for convenience

B. Using shared administrator accounts

C. Removing unnecessary services and enforcing a tested baseline

D. Disabling all logs

Correct Answer: C. Removing unnecessary services and enforcing a tested baseline

Question 9

What is the principal purpose of a DMZ?

A. To place all databases directly on the internet

B. To provide a controlled zone for less-trusted or public-facing services

C. To eliminate the need for authentication

D. To combine guest and management traffic

Correct Answer: B. To provide a controlled zone for less-trusted or public-facing services

Question 10

Which response is most appropriate when a critical system cannot yet be patched?

A. Ignore the vulnerability permanently

B. Expose the system directly to the internet

C. Apply compensating controls, document the exception and set a review date

D. Delete all security logs

Correct Answer: C. Apply compensating controls, document the exception and set a review date