What is network detection and response (NDR)? 

Your organization can use a network detection and response (NDR) solution to monitor its network traffic. The solution identifies cyberthreats and anomalous behaviors across your network, notifies you about network attacks, and can respond to them for you. On top of these things, an NDR solution provides you with network security insights that you can use to take your network protection and overall security posture to the next level.

About NDR

Network detection and response refers to products that apply network behavioral analytics to network traffic data to identify abnormal behaviors, according to Gartner. These products analyze network packets or traffic metadata between internal networks (east-west) and public networks (north-south). They can be delivered through hardware and software appliances, on-premises software, or SaaS.

NDR solutions use artificial intelligence (AI), machine learning (ML), and data analytics to assess network behavior and build models based on it. They detect network threats, notify users as soon as they're discovered, and respond to them accordingly.

Why is Network Detection and Response Important?

Cybercriminals can bypass endpoint detection and response (EDR) solutions and many other security tools and technologies. They can also disable and delete system logs. However, cybercriminals cannot hide in a network — this is why network detection and response is key.

With an NDR solution, you can monitor malicious activity across your network that other security tools and technologies won't necessarily see. Your NDR solution can detect abnormal network traffic flows within your network. This helps you secure your network perimeter and maintain control over what comes into and goes out of it.

How does Network Detection and Response Work?

A network detection and response solution uses ML and other non-signature-based analytical techniques to identify suspicious network activity. It monitors and analyzes network traffic and uses this information to establish a baseline for normal network behavior. If there are any deviations from this baseline, the solution notifies users about potential network threats.

Additionally, an NDR solution gives you insights beyond those provided by a firewall solution. It also identifies suspicious activity that moves across a network that a firewall or endpoint security solution can't.

Threats NDR Solutions Identify

• Unmanaged Internet of Things (IoT) and operational technology (OT) devices
• Unknown or unidentified network systems
• Insider threats
• Lateral movement
• Command-and-control (C2) activity
• Malicious network traffic flows and patterns
• Malware
• Ransomware
• Brute force attacks
• Social engineering
• Data theft and manipulation
• Risky behaviors (like providing remote access to endpoints, sharing user accounts, etc.)

Key NDR Features

• Incident Detection: Identifies anomalies and patterns in network traffic to detect security incidents before they escalate.
• Threat Investigation: Tracks network traffic and patterns and shares this information with security analysts, who can use it to investigate incidents.
• Threat Intelligence: Collects and analyzes threat data from inside and outside of your organization and allows you to share this threat intelligence with other security products, so you can get the most value out of these products.
• Security Alerts: Provides security alerts that give you insights into your organization's security posture and the threats you face. 
• Threat Prevention: Works with your firewall and other security tools and technologies to block suspicious network traffic that can lead to data breaches.  

Network Detection and Response Benefits

Comprehensive Network Visibility

An NDR solution lets you see all of your network activity. If a cybercriminal attacks your network, you'll be able to find out exactly what happened. This helps you understand a cybercriminal's tactics, techniques, and procedures (TTPs) and how to protect against them.

Fast Threat Response and Remediation

With an NDR solution, you can detect network attacks in their early stages. The solution gives you insights into an attack as soon as it begins. You can then stop the attack before it harms your organization, its employees, and its customers.

Foolproof Analytics

Generally, an NDR solution analyzes network packets to assess user and device behaviors and identify attacks. The solution profiles network behaviors across all entities, establishes a baseline based on this information, and detects anomalous attack behaviors. Since the solution uses network data that cannot be tampered with or deleted, it provides a single source of truth for all of network behaviors. 

Cost and Time Savings

You probably won't have to spend a lot of time or money to configure an NDR solution's logs or normalize its log formats. Most NDR solutions can access network packets and parse and store network data out of the box. They can also extract and store the behavioral metadata required to accurately profile network behaviors and detect attacks.

Seamless Cloud Deployment

Many NDR solutions are delivered from the cloud. This means you won't have to deploy log servers to collect and analyze your network data. You can even collect network logs from your firewalls and other network security products and avoid having to invest in and set up network sensors.

Network Detection and Response Challenges

• Evolving Cyberthreat Landscape: Cybercriminals are constantly developing new TTPs to infiltrate networks.
• Expanding Attack Surface: The rapidly expanding digital environment increases the attack surface for cybercriminals — and creates more opportunities than ever before for these criminals to attack networks.
• Cybersecurity Skills Gap: A lack of skilled cybersecurity professionals can make it difficult to implement and manage NDR solutions.
• Budget Restrictions: Many organizations lack the time and resources required to integrate NDR solutions into their day-to-day operations.    

NDR vs EDR

While a network detection and response solution monitors your network traffic, an endpoint detection and response solution looks for suspicious activity across your computers, mobile devices, servers, and other endpoints. If an EDR solution identifies suspicious endpoint activity, it notifies users. Also, an EDR solution can address endpoint attacks and provide analytics that can help you optimize your endpoint protection. 

NDR vs MDR

Network detection and response is a subset of managed detection and response (MDR), which lets you outsource your threat detection and response capabilities to a managed security services provider (MSSP). With an MDR solution, an MSSP hunts for, monitors, and responds to cyberthreats across your IT infrastructure. Your MSSP can address threats on its own or work with you to resolve such issues any time they come up.

NDR vs XDR

An extended detection and response (XDR) solution provides visibility into your network, endpoint, and cloud data. At the same time, the solution lets you automatically detect and remediate attacks across your IT infrastructure. It also offers analytics to help you stay up to date with current and emerging threats.

What to Look for in a Network Detection and Response Solution

Contextual Visibility

If your NDR solution provides contextual visibility, you'll have no trouble viewing all of your network activity in one place. You can see things like which users are using your network, the devices they're interacting with, where they are accessing your network from, and the data that they're sharing. This helps you detect threats, find their source, figure out which users have been compromised, and more.

Non-Signature-Based Threat Detection

Your NDR solution should be able to use ML, behavioral modeling, and other non-signature-based analytics techniques to create a baseline of normal network activity. Then, it can identify threats and issue alerts any time your network traffic deviates from a normal range. This can help you quickly detect any time stolen employee credentials are used to access your network, exfiltration of your network data, and other security issues.

Threat Identification and Alerting

You can pick up an NDR solution that identifies unusual remote access to your network, use of restricted ports or protocols, and other potential threats. The solution also provides high-fidelity alerts and prioritizes them based on their severity. Along with these things, the solution can automatically respond to threats on your behalf.

Threat Detection Engines

A best-in-class network detection and response solution uses a query engine and deep learning prediction model to analyze encrypted traffic and identify patterns across unrelated network flows. The solution utilizes known indicators of compromise (IOCs) to identify threat actors and malicious tactics, techniques, and procedures across encrypted and unencrypted network traffic. It also detects zero-day C2 servers and new variants of malware families and can send alerts based on session-based risk factors.

Easy Management and Reporting

The ideal NDR solution offers a single dashboard for management and reporting. This dashboard can let you view multiple security products at once. It allows you to share information across your security products and automatically respond to security incidents.

Want to know more? Get in touch with a Sophos NDR expert today.

Contact Us

Related security topic: What is a managed security service provider (MSSP)?