A method of responding to the detection of an intrusion on a network system that provides network services, the network system including one or more attached functions (104a-1 04e) and a plurality of network devices including a plurality of network entry devices (105a-105b, 120, 140, 150), the method comprising the steps of: a. initially regulating entry of an attached function to the network system through a network entry device of the plurality of network entry devices (105a-105b, 120, 140, 150); b. acquiring information at the network entry device about the attached function seeking access to the network system ; c. establishing for the attached function at the network entry device one or more signal transfer policies; d. monitoring the network system for intrusions; e. establishing at least one of the plurality of network entry devices (105a-105b, 120, 140, 150) as a network enforcement device including a policy enforcement module configured to change directly signal transfer policies; f. providing at least one of the plurality of network entry devices (105a-105b, 120, 140, 150) with no policy enforcement module ; g. upon detection of one or more intrusions of the network: i. determining a physical address or a logical address for a source associated with the one or more intrusions; and ii. identifying at least one network entry device associated with the source of the one or more intrusions having a policy enforcement module; and h. directly changing, by the policy enforcement module of the identified at least one network entry device, one or more signal transfer policies in response to the one or more detected intrusions. a. initially regulating entry of an attached function to the network system through a network entry device of the plurality of network entry devices (105a-105b, 120, 140, 150); b. acquiring information at the network entry device about the attached function seeking access to the network system ; c. establishing for the attached function at the network entry device one or more signal transfer policies; d. monitoring the network system for intrusions; e. establishing at least one of the plurality of network entry devices (105a-105b, 120, 140, 150) as a network enforcement device including a policy enforcement module configured to change directly signal transfer policies; f. providing at least one of the plurality of network entry devices (105a-105b, 120, 140, 150) with no policy enforcement module ; g. upon detection of one or more intrusions of the network: i. determining a physical address or a logical address for a source associated with the one or more intrusions; and ii. identifying at least one network entry device associated with the source of the one or more intrusions having a policy enforcement module; and i. determining a physical address or a logical address for a source associated with the one or more intrusions; and ii. identifying at least one network entry device associated with the source of the one or more intrusions having a policy enforcement module; and h. directly changing, by the policy enforcement module of the identified at least one network entry device, one or more signal transfer policies in response to the one or more detected intrusions. <EOS>