I keep reading about, and seeing people post and recommend in the oddest places, that strong endpoint protection is better than having a in-service/supported/receiving security updates firewall.

What is the thought process behind this? Is it scale-able to every size of business?

My concern is bad advice might be given to small businesses that just don't know any better and don't have the budget for monthly fees for endpoint protection software like cylance or the like.

  • How does a firewall prevent an infected email attachment from running? Or an infected USB stick? Or a drive-by browser infection?
    – schroeder
    Commented Oct 25, 2018 at 15:09
  • Perhaps you need to define what you mean by "endpoint protection". That's not a well-defined term.
    – schroeder
    Commented Oct 25, 2018 at 15:11
  • And endpoint with no exposed services does not need a firewall.
    – schroeder
    Commented Oct 25, 2018 at 15:11
  • 1
    This is a silly statement in an enterprise context though. You won't have endpoints that are sufficiently locked down to forgo a firewall as too many workflows (especially from the admin side) require the endpoint to have at least some services enabled. Also, you now have to properly configure thousands of devices where one misconfiguration = compromise...
    – DarkMatter
    Commented Oct 25, 2018 at 15:18
  • 1
    @DarkMatter that is my concern, I can only speak for myself when I say there are just some things that CAN NOT be locked down. look at business services/software that still require TLS 1.0 to be enabled, or 3DES/RC4, or printers with antiquated SMB or SNMPv2 I for one can look at my environment and see a multitude of printers varying in vendor and model number, just as an example.
    – Matt
    Commented Oct 25, 2018 at 15:21

2 Answers 2


The answer to this question is not easy. Holistic security is the only answer. If you're going to be Internet-connected, you need both, plain and simple. There are ways to minimize exposure but you need to understand threats and how they pertain to what's important on your network.

If you try to rely exclusively on endpoint protection, what about your devices that don't/can't have endpoint protection? ...printers, cameras, phones, etc. are examples of devices that are commonly exploited in a network where you probably can't layer on endpoint protection.

Conversely, a firewall only protects you at the boundary. Once an attacker is inside, they often have uninhibited access to the internal network and can then laterally move or escalate to effect whatever outcome they're after.

Each business needs to understand what's important for their company. An ecommerce site has their intellectual property (IP) out in front of the world. So they leverage reverse proxies, firewalls, code reviews, as well as host-based protections. A political organization where the users and their information are important would probably focus more heavily on email encryption, attachment sandboxing, disk encryption, AV/AM solutions, etc.

The real answer is that there is no one panacea for security. It's all about evaluating risk and leveraging resources according to what's important to each organization.

My personal opinion is that architecture is the best answer: for non-ecommerce companies, keep everything you can on a closed network that never touches the Internet and for those services that require it (email, web, etc.) that be accomplished in a thin/zero client, non-persistent OS that doesn't have access to the corp net. Any files that need to traverse the Internet-to-closed-net boundary be done by IT staff via a very deliberate process (download, scan, compare hashes, sandbox, move to closed net). This suggestion has its limits but considering the ratio of attacks and vulnerabilities originating from being connected to the Internet, cordoning it off as much as possible, in my opinion, is the best answer.


Another factor to add to this discussion: Endpoint vs firewall depends on your infrastructure.

Traditional companies needed both since data centers were within the perimeter. However, today some companies are "born in the cloud" which means no in house data center which pretty much negates the need for a firewall. Endpoints, by contrast, aren't changing as dramatically. They are still a big target as they are the entry way to your network regardless of how its assembled. Evaluate where your digital assets sit and how to protect them based on location.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .