10 Things You Might Not Know About Network Detection and Response

Network Detection and Response (NDR) is the process of identifying and analyzing security threats on computer networks and responding to them in real-time.

Whether your network is on-premises, cloud-based, or hybrid, you can be sure attackers are constantly trying to get in.

The evidence of their presence and activity is ‘hidden in plain sight’ within your network traffic.

With the advent of AI - and more specifically unsupervised neural networks - NDR can accurately detect and stop suspicious and malicious activity faster than ever.

Security Operations Center (SOC): NDR solutions can provide real-time visibility into network traffic and help SOC teams detect and respond to security incidents more quickly and effectively. SOC and SecOps teams are consistently overloaded. NDR reduces the time it takes to investigate security alerts, improves incident response capabilities, and ultimately strengthens the organization's overall security posture.

IT Operations: NDR benefits IT operations teams by providing them with network visibility and performance analytics. This helps IT teams optimize network performance, identify potential bottlenecks, and troubleshoot issues more effectively.

Compliance and Risk Management: NDR solutions can help organizations meet regulatory compliance requirements by providing continuous monitoring and threat detection capabilities. This is particularly helpful for organizations subjected to data protection regulations like GDPR, CCPA, and HIPAA.

Executive Leadership: NDR provides valuable insights to executive leadership by offering an overall view of the organization's security posture. This helps leaders understand the organization's risk exposure and make more informed decisions about security investments and priorities.

A detection and response strategy involves a multi-layered approach that includes both proactive and reactive measures. The goal is to detect and respond to security threats in a timely and effective manner, to minimize the impact of potential attacks, and protect the organization's assets and reputation.

NDR is an important component of this strategy. NDR solutions are designed to monitor network traffic in real-time, using advanced analytics to detect anomalies and potential threats. By analyzing network traffic, NDR can identify patterns of behavior that may indicate a potential attack, such as unusual communication between devices or unauthorized access attempts.

Endpoint Detection and Response (EDR) is another important component of a comprehensive detection and response strategy. EDR solutions are designed to monitor endpoints, such as laptops, desktops, servers, and mobile devices, for signs of malicious activity. EDR can detect and respond to threats at the endpoint level, providing additional visibility into potential threats that may not be detected by network-based solutions.

Extended Detection and Response (XDR) is a more recent development that combines the capabilities of both NDR and EDR, along with other security technologies, into a unified platform. XDR provides a holistic view of the organization's security posture, enabling security teams to detect and respond to threats more effectively.

A combination of NDR, EDR, and XDR technologies is essential for an effective detection and response strategy. Each technology provides unique capabilities and insights that are critical for identifying and responding to security threats. By using these technologies in combination, organizations can increase their overall security posture and better protect themselves against a wide range of threats.

Some of the key data sources that NDR solutions rely upon include:

• Network traffic data: Network traffic data (including source and destination of network traffic, the type of traffic, and the volume of traffic) is used to detect anomalies and potential threats
• Network device data: Data on the devices connected to the network - including information on the operating system, applications, and configuration settings - helps to identify potential vulnerabilities that could be exploited by attackers
• Network behavior data: Machine learning and behavioral analysis can identify abnormal patterns of behavior on the network, e.g., deviations from normal behavior, such as unusual communication between devices or unauthorized access attempts.
• Security data: Threat intelligence feeds and vulnerability data help identify potential threats and vulnerabilities on the network.

Network Detection and Response (NDR) solutions rely on both behavioral and signature-based analysis to identify potential threats on the network.

Behavioral analysis involves looking for anomalies or deviations from normal network traffic behavior - which can identify potential threats without a known signature or that are using new and previously unseen attack techniques.

Signature-based analysis, on the other hand, involves comparing network traffic against a database of known signatures or patterns of malicious behavior. This remains useful for identifying known threats like malware or other types of attacks that have been previously identified and documented.

By leveraging both approaches, NDR solutions can identify a wider range of threats and help security teams respond quickly and effectively to security incidents.It's worth noting that some NDR solutions place a greater emphasis on one approach over the other. This can often be traced to the solution’s AI strength. See our AI white paper for greater depth here.

Here's a breakdown of how NDR works:

1. Network data is collected from multiple sources, including network traffic, device data, and security data.
2. Data is analyzed using advanced analytics and machine learning algorithms to identify potential threats. Behavioral and signature-based detection techniques identify potential threats.
3. Threat intelligence feeds are leveraged to identify and block known threats, as well as to help identify new and emerging threats.
4. Threat alerts are generated based on the severity of the threat and the potential impact to the organization.
5. Detailed threat information is packaged and presented to security analysts, including suggested remediation - helping security teams quickly triage an otherwise impossibly-sized alert haystack.
6. Finally, NDR helps security teams make informed decisions about how to respond to security incidents, such as automatically blocking traffic from known malicious sources, quarantining infected devices, or triggering additional investigation or incident response processes.

Not all NDR solutions use artificial intelligence (AI), but many do.

AI and machine learning (ML) technologies can be used to improve the accuracy and effectiveness of threat detection, by analyzing large amounts of data and identifying patterns and anomalies that may be missed by human analysts.

That said, the use of AI, ML and neural networking and deep learning vary significantly across the NDR solution landscape. More advanced solutions rely upon neural networking and deep learning capabilities - which helps security teams respond far more quickly and effectively to security incidents. Our recent whitepaper on this topic helps security leaders and practitioners understand how to examine vendor approaches.

NDR deployment will depend on the organization's specific network infrastructure and security requirements.

First and foremost, physical or virtual traffic sensors must be deployed at key network traffic points to gain visibility into network traffic appropriately. These sensors can be deployed in a variety of locations, including at the network perimeter, within the internal network, and in the cloud.

For organizations with a single location network, NDR solutions can be deployed in a centralized manner, with traffic sensors installed at the network perimeter and within the internal network.

For organizations with multiple locations, NDR solutions may need to be deployed in a distributed manner, with traffic sensors installed at each location. This approach can provide centralized visibility into network traffic across all locations.

For organizations that have a hybrid network infrastructure with a mix of on-premises and cloud-based resources, NDR solutions must be able to monitor both environments through the use of physical/virtual sensors on-premises and virtual traffic sensors within cloud environments.

Collected data is then processed - either centrally or in a distributed manner depending on the solution architecture - including analysis, threat intelligence integration, alert generation and prioritization, automated investigation and response capabilities, and integration with other security technologies.

NDR can help organizations meet compliance requirements and regulatory standards in a number of ways:

• Continuous monitoring: compliance frameworks like GDPR, HIPAA, and PCI DSS, require organizations to monitor their networks and systems continuously for potential security threats. NDR solutions provide real-time visibility into network traffic, allowing organizations to identify and respond to threats as they emerge.
• Data protection: By detecting and mitigating threats, NDR solutions help protect sensitive data, such as Personally Identifiable Information (PII) and Protected Health Information (PHI). This is particularly important for organizations that must adhere to data protection regulations like GDPR and HIPAA.
• Incident response: Compliance standards often require organizations to have documented incident response plans in place. NDR solutions can improve incident response times by providing actionable insights and automating certain response actions, helping organizations meet regulations like NIST SP 800-53 and ISO/IEC 27001.
• Auditing and reporting: Many regulatory standards require organizations to keep detailed records of security policies and incidents. NDR solutions can add to logging and reporting capabilities that buttress documentation and evidence for compliance audits.
• Security controls: NDR can help organizations implement security controls specified in compliance frameworks like Center for Internet Security (CIS) Critical Security Controls or NIST Cybersecurity Framework.

NDR can help any organization, regardless of its security maturity - often defined by a framework like CIS, NIST and ISO/IEC 27001 Information Security Management System (ISMS). The value that can be derived from NDR really only increases as an organization steps up its maturity.

Each organization’s security maturity will vary based on factors like security hygiene, security policies and procedures, SIEM/SOAR implementations, network segmentation, security personnel qualifications and experience, and incident response capabilities.

For example, if your organization is at a later stage of cybersecurity maturity - e.g., have a SIEM, EDR, SOC or advanced SecOps team, etc. -  an NDR solution will provide a far more holistic view of suspicious and malicious network activity.

Alternatively, if your organization is at an earlier stage in its cybersecurity maturity, NDR is excellent at pinpointing your greatest risk areas - and where limited staff energy can drive the greatest security impact.