# Closing the door before the horse bolts: Developing a proactive network detection and response (NDR) strategy  Author: Pal Sinha, Barnali Author URL: https://financedigest.com/author/pal-sinha-barnali Published: 2022-11-16 Category: TECHNOLOGY Category URL: https://financedigest.com/category/technology Meta Title: Improving Cyber Security with Enhanced Network Visibility Meta Description: Discover why most cyber-security is reactive, learn from past breaches, understand the challenges of managing devices x security x management, and find the URL: https://financedigest.com/closing-the-door-before-the-horse-bolts-developing-a-proactive-network-detection-and-response-ndr-strategyhtml _By_ **_Adrian Jones,_** _UK country manager,_ [_Gatewatcher_](https://www.gatewatcher.com/en/) It is an unfortunate truth that most cyber-security is reactive.  Despite huge [investment and innovation in technologies and skills](https://www.financedigest.com/quantamental-investment-trends-to-make-profits-through-creative-skills.html "Quantamental Investment Trends to Make Profits Through Creative Skills"), it is only after an attacker has achieved their objectives, that organisations usually discover that a serious incident has occurred. In these instances, [businesses only learn](https://www.financedigest.com/what-b2b-businesses-can-learn-from-b2c-e-commerce.html "What B2B businesses can learn from B2C e-commerce")_after_ a major attack or breach. There have been numerous lessons: from Cam4 to LinkedIn, Yahoo to Marriott or Uber, Home Depot and Facebook, the list of companies that have experienced network breaches continues to grow. So why – despite the innovation of vendors, and the resources spent by [target companies](https://www.financedigest.com/britain-toughens-up-diversity-targets-for-uk-companies.html "Britain toughens up diversity targets for UK companies") – can businesses not get on the front foot? What frustrates the efforts of the security operations centre (SOC) at these organisations? And how can it be remedied? **_Devices x security x management_** The main challenge for organisations stems from how to manage the [security of the network](https://www.financedigest.com/new-demands-on-network-security.html "NEW DEMANDS ON NETWORK SECURITY") and all the devices which connect and communicate across it, effectively.  This has become a ‘cubed’ threat: more devices, multiplied by more security, leading to increased management. These devices include corporate machines, Bring Your Own Devices (BYOD) hardware, [Internet of Things](https://www.financedigest.com/2017-the-year-of-the-internet-of-some-things.html "2017 – The year of the Internet of ‘SOME’ Things") (IoT) sensors, as well as the network infrastructure itself, such as routers and switches. Organisations may also have manufacturing, operational or Industrial [Control System (ICS) environments using protocols such as Supervisory Control and Data](https://www.financedigest.com/dollar-buoyant-as-robust-u-s-data-keep-fed-hawks-in-control.html "Dollar buoyant as robust U.S. data keep Fed hawks in control") Acquisition (SCADA).  Lastly, the [continual growth](https://www.financedigest.com/brand-metrics-continues-on-steep-growth-trajectory-with-appointment-of-vp-business-development-in-the-us.html "Brand Metrics continues on steep growth trajectory with appointment of VP Business Development in the US") of ‘Shadow IT’ must also be accounted for because it can be vital to improved productivity. Having an effective [security strategy](https://www.financedigest.com/2018-it-security-predictions-methods-for-attacks-investment-areas-cybersecurity-strategies.html "2018 IT Security Predictions-Methods For Attacks, Investment Areas & Cybersecurity Strategies") to cover all these technologies and scenarios requires multiple products. Multi-vendor security products lead to multiple dashboards, correlating all the events and alerts across the different platforms. This creates complexity and is a challenge to both [network and security](https://www.financedigest.com/uks-morgan-advanced-materials-reports-cyber-security-incident-on-its-network.html "UK’s Morgan Advanced Materials reports cyber security incident on its network") teams. Despite the best efforts of the latest Security Orchestration, Automation, and Response (SOAR) software, the volume of notifications from systems flagging [changes or anomalies becomes](https://www.financedigest.com/quidditch-becomes-quadball-as-sports-bodies-change-name.html "Quidditch becomes quadball as sport’s bodies change name") overwhelming. False positive alert fatigue – where staff become desensitized to the alert and fail to act appropriately – is all too common. In effect, the holes in the [net get bigger](https://www.financedigest.com/ecb-weighs-bigger-rate-hike-with-safety-net-for-indebted-countries.html "ECB weighs bigger rate hike with safety net for indebted countries"). Even before a [business accounts](https://www.financedigest.com/making-your-accountant-an-invaluable-asset-to-your-business.html "MAKING YOUR ACCOUNTANT AN INVALUABLE ASSET TO YOUR BUSINESS") for increasingly sophisticated threats, the number of alerts means that low noise, advanced persistent threats can stay undetected for months. **_Into the unknown_** The solution to this issue is improving the _quality_ of the visibility across the network. In this respect, quality is determined by the delivery of relevant information, as opposed to large volumes of data, presented to human users and [managers in a format that they can understand](https://www.financedigest.com/understanding-management-theories-and-maximising-productivity.html "Understanding management theories and maximising productivity"). The objective is to detect and remedy issues before they arise. The adage: “You cannot [hit](https://www.financedigest.com/delta-sees-return-to-profit-as-travel-demand-hits-historic-levels.html "Delta sees return to profit as travel demand hits ‘historic’ levels") what you cannot see,” is relevant. By enhancing visibility, an [organisation can understand exactly what type of devices are on the network](https://www.financedigest.com/6-steps-to-organising-an-introvert-friendly-networking-event.html "6 Steps to organising an introvert-friendly networking event "), what systems and applications are being used and which users are accessing these applications. The devil is in the detail. [Knowing more about a risk allows the organisation to control and mitigate that exposure](https://www.financedigest.com/preventing-an-operationally-crippling-ransomware-attack-do-you-know-where-your-risk-exposure-lies.html "PREVENTING AN OPERATIONALLY CRIPPLING RANSOMWARE ATTACK – DO YOU KNOW WHERE YOUR RISK EXPOSURE LIES?"), better and faster. _Meaningful_ visibility of network traffic, is only the first step.  In order to use this information to detect malicious or risky behaviour, [businesses need](https://www.financedigest.com/what-is-premises-liability-coverage-and-why-does-your-business-need-it.html "What is Premises Liability Coverage … and Why Does Your Business Need It?") a qualitative approach that makes sense of what they see. This focus on quality also applies to the management tools themselves.  Multiple, disparate systems make forensics and investigations overly complex.  By integrating multiple, complementary technologies, far greater visibility can be achieved. Especially when reducing tens of management interfaces, to just one or two. **_Integration and collaboration to improve visibility_** This is the realm of complementary, effective technologies under the banner of Network Detection and Response (NDR) using [Cyber Threat](https://www.financedigest.com/cyber-threats-for-finance-organisations-to-watch-in-2023.html "Cyber threats for finance organisations to watch in 2023") Intelligence (CTI) to identify tangible threats, as opposed to large numbers of anomalies. Integrated with Endpoint Detection and Response (EDR), [Security Information](https://www.financedigest.com/privacy-vs-security-is-the-cybersecurity-information-sharing-act-beneficial.html "PRIVACY VS SECURITY: IS THE CYBERSECURITY INFORMATION SHARING ACT BENEFICIAL?") and Event Management (SIEM) and SOAR, these systems can develop a comprehensive, robust strategy for detecting multiple threats across expansive networks.  The are also able to forensically examine the details and history of any attack, dynamically across all assets In short, businesses get both scale and detail. The holes in the net get smaller, even if the net itself is bigger. This level of [response from the cyber-security industry](https://www.financedigest.com/corporate-social-responsibility-within-the-festival-industry.html "Corporate Social Responsibility Within The Festival Industry") has been long overdue. The number of networked devices and the overall attack surface that can be exploited, will expand substantially. In 2022, the market for the Internet of Things alone is [expected to grow to 14.4 billion](https://www.financedigest.com/factbox-big-banks-expected-to-rack-up-more-than-1-billion-in-fines-for-whatsapp-use.html "Factbox-Big banks expected to rack up more than billion in fines for WhatsApp use") active connections. It is expected that by 2025, there will be approximately 27 billion connected IoT devices. Elsewhere, [nearly half](https://www.financedigest.com/nearly-half-of-parents-still-give-pocket-money-to-their-adult-children.html "Nearly half of parents still give pocket money to their adult children") of endpoint devices are at risk because they are no longer on the information technology organization’s radar or critical software is outdated, according to recent research. This is made more pressing as [businesses encounter occasions where they cannot apply cybersecurity technology](https://www.financedigest.com/how-an-advanced-manufacturing-technology-can-make-your-business-more-3-dimensional.html "How an advanced manufacturing technology can make your business more 3-dimensional") on non-standard devices, such as those found in operational technology (OT). **_The response after the detection_** The good news is that prevention strategies do effectively mitigate common and easily identifiable threats.  But even here, Advanced Persistent [Threats and Zero Days are on the rise](https://www.financedigest.com/russian-threat-to-baltic-security-rising-estonian-intelligence-report.html "Russian threat to Baltic security rising – Estonian intelligence report"). As security vendors have evolved their technologies to incorporate Artificial Intelligence (AI) and [Machine Learning](https://www.financedigest.com/machine-learning-engineer-jobs.html "Machine learning engineer jobs") (ML), so too, have adversaries. The number of sophisticated, low noise, long-term attacks will only increase. Detection technologies must not only alert business to these refined attacks, but also keep false positives to a minimum, to [avoid a repeat of the alert fatigue that created](https://www.financedigest.com/5-mistakes-to-avoid-when-creating-passive-income.html "5 Mistakes to Avoid When Creating Passive Income") the issue in the first place! The awkward truth is that attackers only [need to succeed](https://www.financedigest.com/top-5-seo-services-you-need-to-succeed-in-2022.html "Top 5 SEO Services You Need To Succeed In 2022") once.  In the attempt to eliminate this opportunity, [technologies can create large volumes of false positives](https://www.financedigest.com/lumen-registers-increased-views-and-more-positive-response-to-ads-using-seenthis-technology.html "Lumen registers increased views and more positive response to Ads using SeenThis Technology") that reduce the efficacy of the SOC, by making the haystack bigger. Any SOC – and the protection it affords – is only as good as the analysts within it. Those analysts rely on the tooling and threat intelligence that they have at their disposal to ensure the visibility that is the key to the proactive security of the network. --- This blog is powered by Superblog. Visit https://superblog.ai to know more. ---