Security · Topic 6 of 7
Threat Defense, Endpoint Security and Next Generation Firewalls
Describe layered threat defense, endpoint security with EDR and posture, and next generation firewall features such as application control and IPS.
- 5 min
- Defence in depth uses several layers, so one failure does not give access.
- IPS finds attack patterns. Malware protection checks files. DNS layer security blocks bad domains.
- EDR watches the activity on an endpoint. XDR combines data from many sources.
What it is
Network security design combines several layers of protection, so that no single failure lets an attacker through.
Threat defense watches for attacks across the network. Endpoint security protects the devices that people use.
A next generation firewall inspects traffic more deeply than a traditional firewall can. Together they follow the principle of defence in depth.
How it works
Each layer covers gaps that the others leave.
Threat defense
Threat defense is the set of tools and services that find and stop attacks. Common parts are:
| Component | What it does |
|---|---|
| Intrusion prevention (IPS) | Inspects traffic for known attack patterns and can block it |
| Malware protection | Checks files for malicious content, and can track a file after it passes |
| Sandboxing | Runs unknown files in a safe space to watch what they do |
| DNS layer security | Blocks requests to known bad domains before a connection is made |
| Email and web security | Filters spam, phishing and harmful sites |
| Threat intelligence | Feeds up to date information on attackers, domains and files to the other tools |
Cisco Talos is the threat intelligence group that supplies this information to Cisco security products. A good design connects these parts, so what one tool learns about a threat helps the others.
Endpoint security
Endpoints are laptops, phones, servers and other devices. They are a common point of entry, and they sit outside the firewall when users travel. Controls include:
- Antimalware and EDR: endpoint detection and response watches the activity on a device, finds suspicious behaviour and lets a team isolate the device. Cisco Secure Endpoint is the Cisco product in this area.
- Host firewall: a firewall on the device itself.
- Patching and hardening: keeping software up to date and removing what is not needed.
- Posture checks: before a device joins the network, the network checks that it meets rules, such as an up to date antivirus. Cisco ISE can do this and can place a failed device in a restricted network.
- Access control: 802.1X and network access control decide which devices may connect.
Extended detection and response (XDR) goes further, by joining data from endpoints, the network, email and other sources to find an attack that spans several of them.
Next generation firewall
A traditional firewall decides on addresses, ports and the state of a connection. A next generation firewall (NGFW) does that and also looks at the application and the content.
| Feature | Description |
|---|---|
| Stateful inspection | Tracks connections and allows return traffic |
| Application visibility and control | Identifies the application, not only the port, and applies policy to it |
| IPS | Detects and blocks attacks in the traffic |
| URL filtering | Allows or blocks web sites by category or reputation |
| Advanced malware protection | Checks files crossing the firewall |
| TLS decryption | Decrypts traffic so it can be inspected, then re-encrypts it |
| Identity awareness | Applies policy by user or group, and not only by address |
An NGFW can follow a flow that uses a non standard port, because it recognises the application. A traditional firewall that looks only at ports can be fooled by this.
Cisco Secure Firewall
The Cisco NGFW is Cisco Secure Firewall, which was previously called Firepower. The software that runs on it is Secure Firewall Threat Defense (FTD). It is managed by:
- Secure Firewall Management Center (FMC): a central manager for many firewalls.
- Firewall Device Manager (FDM): a built in manager for a single device.
An access control policy holds the rules. Each rule has an action, such as Allow, Trust, Monitor or Block.
A rule can also attach an intrusion policy, a file policy and logging. Rules are checked in order from the top.
Where an NGFW sits
An NGFW can be placed in different ways.
- Routed mode: the firewall is a Layer 3 hop, with an address on each interface.
- Transparent mode: the firewall acts as a Layer 2 bump in the wire.
- Inline or passive IPS: it watches or blocks traffic without taking part in routing.
The usual place is the internet edge and in front of the data centre, with zones that separate inside, outside and a demilitarised zone for public servers.
Layers working together
An example shows the idea. A user clicks a link in an email, and DNS layer security may block the domain.
If it does not, the NGFW URL filter may block the site. If a file still arrives, the endpoint tool may stop it. Each layer is a second chance.
What to remember for the exam
Seven facts cover most questions on this topic.
- Defence in depth uses several layers, so one failure does not give access.
- IPS finds attack patterns. Malware protection checks files. DNS layer security blocks bad domains.
- EDR watches the activity on an endpoint. XDR combines data from many sources.
- Posture checks test a device before it is allowed on the network.
- An NGFW adds application control, IPS, URL filtering and decryption to a stateful firewall.
- Cisco Secure Firewall runs FTD software, managed by FMC or by FDM.
- An access control policy is read from the top, and each rule has an action.
When a question says the firewall must control by application and not by port, the answer is a next generation firewall.
Common mistakes
These four mistakes appear often.
Treating the firewall as the whole defence. An endpoint that is already infected sits behind it.
Confusing EDR with a traditional antivirus. EDR records behaviour and allows response, not just signature scans.
Forgetting that encrypted traffic hides threats. Without decryption, an NGFW cannot inspect it fully.
Mixing up FMC and FDM. FMC manages many firewalls, and FDM manages one device.
Decrypting traffic raises privacy and legal questions, so apply it to the categories your policy allows.
Check yourself
Work through these three questions.
What does an NGFW add to a stateful firewall?
It adds application visibility and control, IPS, URL filtering, malware protection and decryption.
What is the role of a posture check?
It tests whether a device meets the rules before it is allowed to join the network.
Which tool manages many Cisco Secure Firewall devices from one place?
The Secure Firewall Management Center (FMC).
Topic 6 of 7 in Security
Test yourself on Security
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.