Network Detection & Response (NDR)

Network Detection and Response (NDR) is a technology solution which uses artificial intelligence, machine learning and behavioural analytics to monitor network traffics. This provides a baseline of activity which can be used to track any malicious or anomalous activity and identify potential threats. This continuous analysis evolves with the network, ensuring that it is always up to date.

What does NDR do?

Previously, Network Traffic Analysis (NTA) was the established method of monitoring company’s networks, however, as cyber-criminals became more advanced, there came a need for a more innovative solution. NDR technology builds on the capabilities of NTA by adding behavioural analysis and threat response. Gartner renamed the solution ‘NDR’ in 2020 as a more relevant description of what NDR does.

The type of cybersecurity risks NDR searches for include unknown malware, targeted attacks, insider attacks, and risky behaviour.

Why do you need NDR?

Traditional threat detection tools operate by looking for unique Indicators of Compromise (IoCs) and signatures. They can identify these from the line of code, file hash, or size of the malware variant. This information is updated in databases and means that threats can be detected by scanning for the presence of these signatures in network traffic.

However, this is very limiting. These tools cannot detect new or unknown malware or threats because they can only identify threats that they already know. They are detection-focused, which is no longer effective against modern cyber security threats. In contrast, NDR solutions are dynamic, so they can actively hunt for threats. This makes them essential to maintaining a healthy network security. Even when a threat is unknown, NDR technology can identify it and alert the security team, so protecting the entire network. NDR solutions provide incident response automation and tools, alerting SOC teams to potential malicious activity and running an automated incident response to optimise threat investigations and minimise impact. Overall, these systems ensure increased visibility across the network.

NDR provides security teams with broad attack visibility and knowledge of potential threats, which means that false negatives are largely avoided. As well as this, it provides additional analytical data, which lead to increased accuracy in threat detection. By using technology such as behavioural analytics and AI, NDR provides more precise and accurate threat hunting, as well as out-of-the-box detection.

NDR is more efficient than alternative solutions. Threats are detected early on which mitigates attacks before damage is done to the network. Cloud-delivered analytics also has increased access for remote workers which is very important for workers today.

The SOC triad

Having an NDR solution complements the ‘SOC visibility triad’ (Network Detection and Response (NDR), Endpoint Detection and Response (EDR), and Security Information and Event Management (SIEM)) which ensures a completely protected security portfolio as security teams are provided with all the necessary tools to hunt threats.