https://www.sans.org/reading-room/whitepapers/clients/endpoint-security-device-configuration-policy-network-isolation-37095