Protection of Information Assets · Topic 3 of 8
Network, Endpoint Security and Data Loss Prevention
Firewalls, DMZs, segmentation, VPNs and zero trust, IDS and IPS, endpoint protection and EDR, and data loss prevention for data in use, motion and rest.
- 3 min
- Firewalls default deny; rules have owners and are reviewed.
- DMZ for public services; segment the internal network.
- IDS detects; IPS prevents.
What it is
Network security controls what traffic can flow between networks and systems. Endpoint security protects laptops, desktops, servers and other devices. Data loss prevention (DLP) finds sensitive data and stops it leaving the organization through unauthorized channels.
How it works
Firewalls
| Type | Inspects |
|---|---|
| Packet filtering | Source and destination addresses, ports and protocols, one packet at a time |
| Stateful inspection | Tracks connections, allowing return traffic only for sessions started legitimately |
| Application-level (proxy) | Content at the application layer; the proxy connects on the client's behalf |
| Next-generation firewall | Combines stateful inspection with application awareness, user identity and intrusion prevention |
| Web application firewall | HTTP traffic to web applications, blocking attacks such as SQL injection |
Rules should follow default deny, be documented with a business reason and owner, and be reviewed periodically to remove unused or overly broad rules. Changes go through change management.
Network architecture
- Demilitarized zone (DMZ) or screened subnet: public-facing servers sit between an external and internal firewall, so a compromise does not give direct access to the internal network.
- Segmentation: separate zones for sensitive systems, users, guests and IoT, limiting how far an attacker can move.
- Virtual private network (VPN): an encrypted tunnel for remote access or site-to-site links, with MFA for users.
- Zero trust: no implicit trust based on network location; every request is authenticated, authorized and checked against device health.
Intrusion detection and prevention
| Control | Action |
|---|---|
| Intrusion detection system (IDS) | Detects suspicious traffic and alerts; passive |
| Intrusion prevention system (IPS) | Sits inline and blocks suspicious traffic |
| Signature-based | Matches known attack patterns; misses new attacks |
| Anomaly or behavior-based | Flags deviations from normal; finds new attacks but gives more false positives |
Endpoint security
- Hardening to a secure baseline: remove unneeded services, change defaults, apply patches.
- Anti-malware and endpoint detection and response (EDR), which records endpoint activity and helps detect and contain attacks.
- Host-based firewalls and full-disk encryption on laptops.
- Application allowlisting so only approved software runs.
- Control of removable media and local administrator rights.
Data loss prevention
| DLP type | Where it works |
|---|---|
| Network DLP | Data in motion: email, web uploads, file transfers |
| Endpoint DLP | Data in use: copying to USB, printing, pasting into web forms |
| Storage (discovery) DLP | Data at rest: finds sensitive files on shares and in cloud storage |
DLP depends on data classification: it can only protect what it can recognize. New DLP rules are often run in monitor mode first to tune out false positives, then switched to block mode.
When a question asks which control comes first in a DLP program, look for data classification and discovery of where sensitive data lives.
How the exam asks about this
- "Public web servers should be placed where?" In a DMZ, separated from the internal network.
- "Which control blocks attacks inline?" An IPS, not an IDS.
- "Staff email customer files to personal accounts." Network DLP based on data classification, plus policy and awareness.
What to remember for the exam
- Firewalls default deny; rules have owners and are reviewed.
- DMZ for public services; segment the internal network.
- IDS detects; IPS prevents.
- EDR, hardening, encryption and allowlisting protect endpoints.
- DLP needs classification; it covers data in motion, in use and at rest.
A firewall rule base that has grown for years without review usually contains "any to any" rules that silently undo the network design.
Common mistakes
Confusing IDS and IPS.
Deploying DLP before classifying data.
Assuming internal traffic is safe. Zero trust and segmentation address this.
Check yourself
What does a stateful inspection firewall track?
The state of connections, allowing return traffic only for legitimately established sessions.
Which DLP type finds sensitive files sitting on file shares?
Storage or discovery DLP for data at rest.
What is the main purpose of a DMZ?
To isolate public-facing systems from the internal network.
Topic 3 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.