WHAT IS NETWORK DETECTION AND RESPONSE (NDR)?

The basics of network detection and response

Data collection

Network detection and response monitors traffic in real-time from a variety of sources, including network firewalls, cloud packet mirrors, SPAN ports and virtual and physical Test Access Points (TAPs). It collects and logs data related to network activity and structures it into detailed, correlated logs enriched with environmental data like system/service identification, etc. for further analysis in a security information and event management (SIEM) or threat investigation platform.

Traffic monitoring in any environment

NDR can deploy to hybrid and multi-cloud, on-premises, and air-gapped environments to provide security teams with a complete and integrated view of network activity. SOCs can observe north/south (intranet/Internet) and east/west (lateral) traffic, traffic from remote users, encrypted traffic telemetry, OT/ICS systems and more. An NDR platform typically deploys a mix of hardware sensors, cloud sensors, software sensors and virtual sensors tailored to the specifics of the organization’s infrastructure. With many organizations migrating to cloud environments, network detection and response provides the deep network analytics and insights cloud security solutions, such as CSPM and CWPP, do not supply because of their reliance on VPC flow logs.

Long-term package capture (PCAP) and storage for improved forensics

Best-in-class NDR platforms can optimize packet capture (PCAP) to capture only the relevant traffic, which reduces the expense of storage and allows investigators to review network events over longer periods of time.

Why is network detection and response so valuable?

After decades of work and billions of dollars in investments, there is still no way to “keep the bad actors out” every time.

Cybercriminals continue to succeed because they create new, more sophisticated tactics, techniques and procedures (TTPs) that evade defenses such as firewalls and  endpoint detection and response (EDR). Once attackers access the network, these tools do not have the capabilities to track their movements. “You can’t defend what you can’t see” is still an immutable fact of cybersecurity — and it’s also a core argument for NDR.

There are other considerations. Organizations have interconnected and unmanaged endpoints and IoT devices that expand networks, and more data streams than ever before. This can create additional security monitoring challenges, including:

• Excessive, noisy alerts that overwhelm SOCs
• False positives and incomplete analysis that waste resources and miss actual patterns of intruder activity
• Incomplete datasets or non-standardized data collection, which can  slow down and degrade analysis
• Attackers exploit normal traffic patterns, tools and applications to “blend in” and evade detection, often for weeks or months after an initial breach.

The silver lining is that attackers are human and also make mistakes. Discovering their presence and activities often only requires finding a single clue from which a broader attack pattern is revealed.

But to bring those clues across their dashboards, SOC teams need to consistently collect and synthesize evidence. NDR’s core function is to observe and make sense of all network traffic, whether it comes from a cloud, a Kubernetes cluster, a data center, an OT system or elsewhere. Network data contains immutable clues about the nature and behavior of devices, applications and assets. Delivering those clues to analysts and threat hunters in a timely, contextualized format is the core force-multiplier that NDR can deliver.

Many SOCs rely on EDR to provide coverage in depth and SIEM for aggregation and analysis. In the face of advanced persistent threats (APTs) and novel attack patterns, this combination lacks the breadth of coverage — specifically, insights from the network — that SOCs need for comprehensive defense. NDR supplies a critical last piece of the defense equation, which is often represented as the SOC Visibility Triad.

Organizations that can’t monitor their networks 24/7 and keep relevant evidence on hand for months (or ideally years) operate at a huge disadvantage. The network is still the “ultimate source of truth” that provides the clues blue teams need for quick incident detection and resolution and proactive threat hunting.

The SOC Visibility Quintet

The expansion of cloud networks, applications and identity and access management have brought many security experts to question whether a conceptual expansion of the SOC Visibility Triad is warranted. Jean Schaffer, former CISO of the Defense Intelligence Agency and Corelight’s Federal CTO, has proposed a “quintet” that treats cloud and identity as two additional pillars needed for complete visibility. Other concepts of holistic visibility exist, but most consider EDR and NDR to be essential to a holistic view of the organization.

Instrumenting network detection and response

NDR deployment typically begins by identifying the critical network segments and strategic sensor deployment. Often the process begins with a pilot deployment in a limited environment where the platform is tuned before expanding to its full scope. Most NDR sensors sit out of band, which minimizes disruption within the ecosystem

North/south deployments

Placing network sensors at north/south access points allows the SOC to monitor data flowing between the internal network and external entities, such as the Internet, cloud services, or OT networks.

SIEM, XDR, EDR, firewall and ecosystem integrations

If SOC teams do the triage centrally in a SIEM, NDR data can be fed  into SIEMs or  XDR platforms  through simple API connections. Other options include doing the triage and storing data in the NDR analytics interface and only feeding triaged data to the SIEM or XDR solutions.

East/west deployments

East/west traffic includes communication between devices connected to the same internal network, such as servers and endpoints. These sensors typically deploy after north/south monitoring has already been established. Location is highly dependent on the specific business needs of the organization and where data transfers are at heaviest volume.

Locations

Network detection and response can deploy to virtual and physical environments including headquarters, automated infrastructure, remote offices and more.