A manufacturing company recently experienced a network-down scenario due to malware spread on the management network. The company wants to implement…

Endpoint Detection and Response (EDR) is the most suitable solution. The problem describes malware spreading on the management network, which implies that endpoints (servers, workstations) were compromised. EDR solutions are specifically designed to continuously monitor these endpoints to detect malicious activity, contain threats at the source, and provide remediation capabilities. By deploying an EDR solution like Cisco Secure Endpoint, the company can gain visibility into endpoint behavior, automatically block known malware, and rapidly respond to new threats, directly addressing the requirement to detect and mitigate similar future incidents.

B. RADIUS: This is an authentication, authorization, and accounting (AAA) protocol used for network access control, not for detecting or mitigating malware on an already-connected device.

C. encrypted threat analysis: This technology analyzes network traffic patterns to find threats within encrypted flows. While useful, it does not address the malware residing and executing directly on the endpoint itself.

D. IPsec VPN: This provides secure, encrypted tunnels for data in transit between networks. It protects data from eavesdropping but does not inspect the payload for malware or protect the endpoints.

1. Cisco Secure Endpoint Data Sheet: "Cisco® Secure Endpoint is a cloud-managed endpoint security solution that prevents breaches, and detects and responds to advanced threats... It integrates prevention, detection, threat hunting, and response capabilities in a single solution, leveraging the power of the cloud to protect your organization from even the most advanced threats." This document explicitly details how EDR functions to prevent, detect, and respond to malware on endpoints.

Source: Cisco, "Cisco Secure Endpoint Data Sheet," Page 2, "What it does."

2. Cisco SD-WAN End-to-End Security Design Guide: This guide discusses layered security approaches. It positions EDR (like Cisco AMP for Endpoints/Secure Endpoint) as a critical component for host-level protection. In contrast, it describes IPsec's role for transport security and ETA's role for network traffic analysis.

Source: Cisco, "Cisco SD-WAN End-to-End Security Design Guide," Section: "Endpoint Security," Page 15.

3. Cisco Identity Services Engine (ISE) Administrator Guide: This documentation describes the function of RADIUS within a network security architecture. "The RADIUS protocol is used to communicate information between a network access server and a RADIUS authentication server." Its purpose is clearly defined as AAA.

Source: Cisco, "Cisco Identity Services Engine Administrator Guide, Release 3.1," Chapter: "Fundamental Concepts of Cisco ISE," Section: "RADIUS Protocol."

4. Encrypted Traffic Analytics White Paper: "Encrypted Traffic Analytics is a technology that allows organizations to analyze encrypted traffic to detect threats without decryption... It is focused on identifying malware communications in encrypted traffic through passive monitoring." This highlights its role in network analysis, not direct endpoint remediation.

Source: Cisco, "Encrypted Traffic Analytics White Paper," Page 3, "Introduction."