What is network discovery and how does it work?

In the interests of security and performance, engineers must quickly find network problems and try to fix them right away. This is Network Detection and Response (NDR).

NDR is a very important element of an organization's security strategy. But what exactly is it?

NDR uses non-signature-based techniques (unlike antivirus and antimalware software) such as machine learning to detect suspicious traffic that may indicate a cyberattack. NDR solutions analyze network traffic and flow data to build models that determine standard traffic, then detect deviations and generate alerts.

Reacting is also an important function of NDR. Automatic reactions (e.g. sending commands to the firewall to remove suspicious traffic) or manual reactions (e.g. providing tools for searching for threats) are its flagship functionalities.

Security Operations Center (SOC) Visibility Triad

While NDR is critical to network and IT security, it's equally important to have complementary solutions in place to provide comprehensive protection for your organization.

One concept is the SOC Visibility Triad. According to her, the implementation of complementary security tools that compensate for each other's shortcomings significantly reduces the chances that attackers will achieve their goals.

The three pillars of the triad are:

• EDR for endpoint security,
• SIEM for log processing and event correlation,
• NDR to analyze behavior from a network perspective.

The first one, SIEM, is responsible for managing security information. In a large landscape, IT needs a way to collect and analyze all relevant logs. Doing it manually is very time consuming and not cost effective, so having a SIEM solution is critical to staying secure and saving resources.

The second pillar, EDR, prevents endpoint breaches. Such an invasion could lead to a real disaster, which is why it is one of the most important parts of well-planned protection.

The third pillar is NDR, or network detection and response. In addition to network hacks, the solution also:

• segregates problems
• it limits them to what really matters
• filters noise.

NDR allows the IT team to get to the elements that really matter and determine their actual impact on the landscape.

These solutions use analytical techniques to detect suspicious traffic on corporate networks. The tools continuously analyze motion and flow records to build models that reflect standard behavior.

SIEM and EDR are important solutions, but they leave blind spots in defense. If we add NDR to this, it fills network security gaps.

This will be because every resource in the cloud or on-premise data center uses the network to communicate. This makes the NDR the best source of information on hybrid safety. Advanced solutions are also able to monitor and analyze encrypted traffic. It is estimated that this is how 90% of malware is hidden.

Progress Flowmon is a flow-based network performance monitoring solution that allows you to track bandwidth usage, understand traffic patterns, and pinpoint the root cause of network issues across on-premises, edge, and cloud environments.

It is an excellent supplement to the protection of any organization.

If you want to learn more about the solution, please contact Tomasz Domalewski, who is the maintainer of this solution at Bakotech.