Detecting and responding to cyber threats

Detection and response to cyber threats

NDR (Network Detection and Response) is an essential part of the cyber security architecture. It offers advanced capabilities to detect, investigate and automatically respond to cyber threats in real-time network traffic.

Powerful NDR solutions use in action:
- advanced machine learning tools
- artificial intelligence
- integration with other tools such as SOAR

The main task of the NDR is to model the attacker's tactics, techniques and procedures.
In a continuous system, it monitors the network to detect threats and non-standard events.

It is based on the MITRE ATT&CK framework, which allows the algorithms to detect the initiation of an attack based on the very behaviour of the hacker in relation to the secured system.

By analysing the environment extensively, they extract the relevant information and correlate it with events, time, users, applications and deviations from previously recorded patterns of actions and actions taken. This makes it possible to minimise the time required for verification activities and actions.

The security data acquired and the threat summaries made are transferred to the System for Information Security Event Management (SIEM) for further comprehensive security assessment.

Automation of actions in response to a recorded security event

NDR systems can do much more than analyse data and report suspicious activity. Their operation can go much further and, within the framework of implemented rules, they can perform active actions even before the security team has taken an incident.
Thanks to both native and customised controls, they are able to disconnect a user or system in real time and prevent the continuation of an attack or data theft.
Additionally, thanks to their integration with other solutions such as EDR or SOAR, their importance in the overall security system is unquestionable.

SOC Visibility Triad

This is an approach hatched by Gartner as early as 2019, which points to the need to change the way we look at network security and put it at the centre.

It consists of three elements that complement each other:
- network protection - based on device interaction - Network Detection and Response (NDR)
- endpoint protection - with regard to detailed analysis of processes running on, for example, workstations or servers and the interaction between them - Endpoint Detection and Response (EDR)
- analysis of recorded data - logs - collected during the operation of individual systems and their juxtaposition with data obtained from other sources - Security Information and Event Management (SIEM)

The use of several cooperating solutions can, on the one hand, help to detect, for example, events that do not register in the logs, but whose behaviour in a given process or system is undesirable or harmful. On the other hand, with a large number of actions performed, the logs may record an unusual event that may not be a threat at the moment but is part of the preparation for an attack. E.g. non-standard log-in times or its location for a particular user, which could be a signal of a log-in data takeover or identity theft.

AI assistance and behavioural analysis

Artificial intelligence (AI)-based NDR platforms collect and store relevant metadata and enrich it with AI-derived security insights.
The right use of AI can help detect attackers in real time and conduct efficient investigations.
Properly 'learned' AI is able to ignore anomalies and respond almost exclusively to real attacks at various stages of sophistication. This reduces the amount of intervention by SOC teams and their involvement in checking non-threat reports.  

Advantages of NDR solutions

1. continuous observation of all users, devices and technologies connected to the network:
- from the data centre to the cloud,
- from institutional users to home users,
- from IaaS to SaaS
- from printers to IoT devices
2 Using behavioural analytics and ML/AI to directly model attacker behaviour and detect advanced attacks.
3. Improving the efficiency and effectiveness of SOC teams.
4. integration with EDR and SOAR solutions


Security Orchestration, Automation, and Response (SOAR)

Security Orchestration, Automation, and Response (SOAR) technology is a set of services and tools that automate cyber attack prevention and response. This automation is achieved by unifying integration, defining how tasks are performed and developing an incident response plan that meets the needs of the organisation.

With SOAR, SOC teams that were previously swamped with repetitive and time-consuming tasks are able to resolve incidents more efficiently, reducing costs, closing gaps in coverage and increasing productivity.
Orchestration brings together internal and external tools, including off-the-shelf and custom integrations, so that they can be used in one central location. This allows you to consolidate data and streamline processes to prepare the ground for automation.

Automation is used to program tasks to be performed automatically. This is done through workbooks or collections of workflows that are triggered automatically when triggered by a rule or event. Workbooks allow tasks to be automated, alerts to be managed and responses to threats and events to be created.

Orchestration and automation form the basis of artificial intelligence-based event response, which enables faster and more accurate responses and results in fewer security issues to resolve.

SOAR technology provides a comprehensive system that automatically identifies and responds to security vulnerabilities without human intervention. With SOAR tools, an organisation can define and configure how it will respond to an incident.

Benefits of SOAR

- Increased productivity, reduce repetitive, time-consuming tasks and ongoing operations. This allows the team to work smarter, not harder.
- Cost optimisation, consolidating security providers can help reduce operational costs.
- Faster response, by automating the response to incidents in different scenarios, SOAR tools significantly reduce the average response time, resulting in faster and more accurate solutions.
- Centralised view of activities, integrating different tools from different suppliers and making them all available in one place. Teams can conveniently access the information they need to investigate and correct incidents.
- Easy collaboration and deployment, orchestration tools unify systems, providing the right tools and data needed to make more informed decisions.
- Preventing evolving attacks, SOAR threat analytics provides data-driven better insights into potential threats and more effective investigation of complex incidents.

#NDR #cybersecurity #threatdetection #artificialintelligence #MITREATTACK #SIEM #automation #EDR #SOAR #security #SOCVisibilityTriad #cybersecurity #AIsecurity #threatdetection #networksecurity #endpointsecurity #securityanalytics #automation #response #orchestration #threatmanagement #SOC #securitydata

22.04.2024
źródło: Vectra AI, Microsoft