[Whitepaper] XDR vs. NDR/NTA – What do Organizations Truly Need to Stay Safe?

Security teams whose organizations are outside the Fortune 500
are faced with a dilemma. Most teams will have to choose between
deploying either a network traffic analysis (NTA) or network
detection and response (NDR) tool or an endpoint detection and
response (EDR) tool to supplement their existing stacks.

On the other hand, some organizations are getting the best of
both options by switching to extended detection and response (XDR)
tools which often provide all these tools in one solution.

This is the key takeaway of a new whitepaper by security
provider Cynet (download it here^[1]).

NDR tools have become more popular, and for a good reason. They
offer organizations a variety of benefits and can help further
secure an environment from lateral movement attacks and further
infiltration if an initial attack succeeds. NDR tools can detect a
wide range of malicious activities and anomalous behaviors.

The question is whether the strengths of an NDR tool outweigh
its limitations.

The pros and cons of NDR

NDR and Network analytics tools offer two major benefits for
organizations: threat detection and operational impact.

Network analytics tools can help organizations detect and track
a variety of anomalous behaviors and malicious actions that could
indicate an attack, including:

• Malicious authentications through anomalous user actions
• Network-based reconnaissance activities
• Unusual login attempts that happen too close to each other, or
  that deviate from network behavior patterns.

Additionally, network analytics tools are unintrusive. They do
not require endpoint installation and don’t impact live network
traffic. They can also be ideal for organizations where users are
not expected to install agents.

On the other hand, network analytics tools fall short when it
comes to protecting the individual endpoints in an environment.
They aren’t equipped to detect malicious file activity, process
execution, and other indicators of endpoint compromise.

This limits their visibility and ability to protect against
initial attacks. It also restricts their prevention capabilities.
Instead, NDRs and other network analytics tools largely focus on
detection and alerts. They also offer little in the way of
remediation outside of network remediation.

How XDR bridges the gap

The solution XDRs offer to this dilemma is to consolidate a
variety of both detection and response tools into a single
platform. This means that on top of detection and alerts, XDRs can
also automatically respond, investigate and remediate threats and
attacks wherever in an environment they occur. XDRs can include a
variety of tools including:

• NGAV
• EDR
• User and Entity Behavior Analytics (UEBA)
• NTA
• Deception tools

This removes the multiple panes of glass issue and lets
organizations work with single panes. Instead of requiring a stack
that integrated multiple siloed security tools, XDRs can offer a
layered and natively integrated solution that can help detect
threats and respond to them better.

You can learn more by downloading the whitepaper here^[2].