Architecting Resilience: A Practical Evaluation of Intrusion Detection System (IDS) and Unified Threat Management (UTM) in Windows Enterprise Defence-in-Depth 1

This research presents a practical, evidence-based evaluation of layered network security controls for protecting Windows enterprise environments. Windows-based systems remain a core part of organisational infrastructure and face threats including reconnaissance, unauthorised access attempts, and exploitation of exposed services, challenges that a single security control cannot adequately address. The study uses a virtualised lab comprising a Windows 11 Professional endpoint (the case-study system), Kali Linux as a controlled attacker/testing platform, Snort as the Intrusion Detection System (IDS), and pfSense as the Unified Threat Management (UTM) platform. Six controlled scenarios — from baseline connectivity testing through port scanning, firewall bypass testing, and IDS/UTM detection and filtering, generate representative attack and reconnaissance traffic. Network traffic, IDS alerts, firewall decisions, and system responses are collected and analysed to assess detection, prevention, visibility, and monitoring capabilities. Particular attention is given to the interaction between IDS and UTM within a defence-in-depth architecture, including the finding that traffic remaining within the same local network may not traverse a gateway-based UTM device, meaning IDS and UTM play complementary rather than substitutable roles. The paper concludes with practical recommendations for network segmentation, IDS deployment, firewall policy management, and security monitoring, contributing a practical framework for evaluating IDS and UTM capabilities within Windows enterprise defence-in-depth strategies.