Network detection and response, or NDR, is a cybersecurity tool that continuously scans traffic for potential risks by using machine learning and artificial intelligence (AI). When risks are encountered, NDR systems initiate an immediate counterattack and begin to repair any damage.
Enterprise networks that rely solely on legacy network security tools like firewalls are much more vulnerable to attack or infiltration than they would be with a solution that includes NDR. The key benefit is the continuous nature of NDR oversight.
While a firewall (perhaps the most commonly used network security tool) can stop unwanted traffic, filtering is limited to parameters established manually by a security team member. Often, firewalls can only examine specific elements like IP addresses, protocols, and port numbers. NDR, on the other hand, evaluates traffic within a larger context and makes adjustments as it “learns” about network behavior patterns.
For more information, also see:Â Artificial Intelligence in Cybersecurity
How Does NDR Work?
At a high level, an NDR works much like a security camera. These platforms constantly scan the network environment to find intruders who have slipped through the gates. In addition, NDR analyzes the environment and traffic patterns to uncover potential problems and develops automated responses to thwart those attacks.
More specifically, NDR employs non-signature-based techniques like machine learning to uncover unknown attacks alongside signature-based techniques to find known attacks. NDR ingests data from sensors, firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS), metadata like NetFlow, and other network data sources. Traffic flowing in and out of the network can be monitored by NDR in physical and virtual environments. Collected data is stored and analyzed.
Response is perhaps the most critical piece of this security solution. NDR can automate responses. For example, ordering a firewall to drop specific suspicious traffic or sending high-priority alerts to specific SOC analysts.
What are NDR Features?Â
NDR utilizes advancements made in artificial intelligence and data analytics to evaluate network traffic. These features are commonly found in NDR platforms, though specifics vary by provider:
- Cognitive Modeling: This AI-driven process helps the NDR system monitor and analyze tactics, techniques, and procedures (TTP) by simulating and predicting network behavior. Over time, cognitive modeling can lead to better predictions and deeper analysis.
- Real-Time and Historical Traffic Insight: NDR is a significant step up from legacy cybersecurity solutions that are limited by what is known about past behaviors.
- Context Awareness: Context-driven visibility enables NDR to take deep analytical dives and identify suspicious network behavior, based on the system’s expectations for baseline network behavior.
- Integrations: Modern NDR can often be integrated with other network security tools like endpoint detection and response (EDR), security information and event management (SIEM), security orchestration, automation, and response (SOAR), and firewalls.
- Data Analytics: NDR platforms gather and analyze data — information that can be used to guide security operations center (SOC) decision-making and overall business operations.
- Dashboard Interface: NDR platforms include centralized dashboards where security teams can evaluate flagged network traffic, make adjustments to configurations, and create reports reflecting trends, evolving problems, and other notable network behavior patterns.
For more information, also see:Â Why Firewalls are Important for Network Security
Why NDR?
Adopting NDR technology brings two key overarching benefits.
Greater Visibility
The inherent nature of NDR as a real-time monitoring tool adds significantly greater visibility into network security for enterprises that have been relying on less advanced security solutions, including perimeter security like network-based firewalls.
Today’s cybersecurity threats all but guarantee a breach at some point. But enhanced visibility ensures that, when a threat is surfaced, it can be knocked down or isolated quickly. NDR systems look beyond the perimeter and into the network itself.
Less Noise
Traditional perimeter security approaches aren’t sophisticated enough to sort threats confidently. Instead, these systems flag any and all potentially problematic traffic and turn it over to human analysts who must sift through an ever-growing mountain of what turns out to be mostly false positive flags.
SOCs spend an incredible amount of time threat hunting related to legacy cybersecurity solutions. NDR utilizes machine learning AI to establish an expected baseline of network behavior to develop a more accurate picture of true anomalies. When threats are detected by NDR, a network response happens automatically and immediately.
NDR Market
Industry research reports that the global NDR market size is worth an estimated $2.49 billion USD in 2022. By 2028, the market is expected to grow to a value of $5.37 billion USD — a compound annual growth rate (CAGR) of 13.7% during this period.
The rise in cloud networking is contributing significantly to the growth of the global NDR market, making up about a 65% share. The largest industry adopter for NDR technology is the banking financial services and insurance (BFSI) sector, followed by the communications field and industrial applications.
North America is the largest geographic market for NDR with a share of around 70%. Europe and Asia-Pacific make up most of the rest of this market.
For more information, also see:Â What is Big Data Security?
Top 10 NDR Providers
- Blue Hexagon
- Cisco
- ExtraHop
- Fidelis Cybersecurity
- FireEye
- Gigamon
- IronNet Cybersecurity
- Plixer
- Corelight
- Vectra AI
Bottom Line: Beyond Enhanced Network Security
NDR is a significant improvement over legacy network security solutions that focus primarily on the perimeter of a network environment. NDR looks beyond endpoints and specific types of traffic to analyze what is happening across the network in real time. The data insights delivered by NDR can be used to inform both network security decisions and business operations decisions in general.
NDR offers benefits beyond enhanced network security. For example, because NDR analyzes traffic within the context of expected network behavior, these systems reduce the number of false positive flags that SOC analysts need to examine. At a time when trained cybersecurity professionals are scarce, freeing analysts from this tedious task can drastically improve efficiency and the overall security posture since analysts have more time to dig into true threats.
When shopping for an NDR solution, it’s important to look for a provider that can integrate a solution into your existing security approach, if possible. These systems are sophisticated enough to evaluate network traffic wherever it exists, including in the cloud, but disparate components must be able to communicate with one another to ensure full effectiveness.
