Hvad er XDR og NDR, og hvad er deres fordele?

NDR (network detection and response) og XDR (endpoint detection and response) er to ens, men alligevel to tydeligt forskellige tilgange til cybersikkerhed. Antallet af cybertrusler stiger hvert år, derfor leder virksomhedsejere og it-chefer efter nye og mere intelligente måder at afværge disse trusler på, for at holde deres virksomhed kørende på fuld drift kapacitet.

Traditionel antivirussoftware er stadig effektiv og spiller en integreret rolle i at beskytte din virksomhed mod malware, ransomware og andre cybertrusler, men det er ikke længere nok til at tjene som den eneste forsvarsmekanisme. NDR og XDR er to af mange cybersikkerheds løsninger, der præsenterer sig selv som to effektive og vigtige løsninger, der bruger maskinlæring og kunstig intelligens til at forsvare sig mod en nyere og mere dødbringende bølge af cybertrusler. Men at forstår hvordan man bruger NDR og XDR i din virksomhed er ikke altid så ligetil.

Hvordan ved du, hvilken løsning din virksomhed har brug for, og hvad er deres fordele?

HVAD ER NDR?

NDR – Network detection and response er en sikkerhedsløsning, som din virksomhed kan bruge til at opdage enhver mistænkelig eller usædvanlig trafik, der passerer gennem virksomhedens netværk. NDR-software vil konstant analysere trafikdata for at konstruere en norm, der hjælper den med at forstå netværkets sædvanlige adfærd. Dette er et afgørende skridt, da man med denne information nemt kan finde uregelmæssigheder, som skal identificeres og finpudses.

Der efter sendes en meddelelse til netværksadministratorerne, som der kan tage de nødvendige skridt og handlinger for at eliminere truslen, hvis det er nødvendigt. Alternativt kan automatiserede løsninger og andre cyber sikkerhedssystemer bruges til at isolere, tilbageholde og eliminere truslen.

LogSearch tilbyder en meget moderne netværksdetektion og -respons – NDR Platform, nemlig ExtraHop. Læs alt hvad du behøver at vide om det her.

FORDELE VED NDR

At inkludere en NDR-løsning i dit cybersikkerheds system er et stort skridt fremad for din virksomhed og med det, kommer der flere vigtige fordele:

• NDR tilbyder fantastisk beskyttelse mod nye og udviklende malware.
• Bruger AI til at bekæmpe ondsindede cybertrusler, der udvikler sig hver dag for at finde nye svagheder og smuthuller i dit cyber sikkerhedssystemer
• Leverer detaljerede analyser for at hjælpe med at finde ud af, hvordan truslen kom ind på netværket i første omgang, og hjælper med at sikre, at det ikke sker igen
• Hjælper proaktivt med at strømline hændelses respons og trussels jagt processer
  NDR er fantastisk til at opdage malware gennem et netværk. Hvis en XDR-løsning ikke kunne identificere disse trusler, da de ikke er en del af organisationens netværk, kan en NDR-løsning handle hurtigt og effektivt ved brug af kunstig intelligens og avanceret teknologi.

HVAD ER XDR?

XDR – Endpoint detection and response deler nogle ligheder med NDR, men er fundamentalt anderledes af natur. XDR-løsninger fokuserer på at gennemsøge og overvåge alle endepunkter forbundet på dit forretningsnetværk. En XDR-løsning vil overvåge og indsamle disse endepunkter som en NDR og konstruere et “normalt” adfærdsmønster, der så hjælper med at identificere trusler på et øjeblik. Ligesom NDR-løsninger vil XDR-softwaren også informere jeres netværksadministratorer, at en trussel er til stede, for straks at begrænse og eliminere den.

XDR-løsninger bliver vedtaget af flere og flere virksomheder hvert år. Faktisk er der ifølge McAfee en årlig vækstrate på næsten 26% i brugen af ​​XDR-løsninger. Dette er drevet af flere årsager, men primært stigningen i antallet af endepunkter forbundet til erhvervsnetværk. Historisk set ville de eneste enheder, der er tilsluttet et forretningsnetværk, være arbejdscomputere, printere og andre stationære enheder. Men nu har hver medarbejder og enhver der besøger virksomheden oprettet forbindelse til netværket, med både mobile enheder, tablets, bærbare computere, IoT-enheder og mere.

Selvom dette er en kæmpe fordel, når det kommer til at strømline forretningsdrift og processer, er der noget som flere virksomheder skal være påpasselige med, da det åbner op for et stort antal svage punkter i en virksomheds sikkerhed. Kort sagt, med flere endepunkter kommer der flere sårbarheder. Hvert endepunkt, der er forbundet til dit netværk, er en potentiel vej ind for malware og cybertrusler.

Læs mere om vores fortrukne XDR løsning her.

FORDELE VED XDR

Ingen antivirussoftware kan nogensinde være 100% effektiv, da nye strains (stammer) bliver frigivet hver dag. En af de bedste metoder til forebyggelse er ved at tilslutte eller beskytte kilden – dvs. endepunkterne.

XDR-software har derfor flere vigtige fordele:

• XDR fungerer som den anden forsvarslinje efter antivirussoftware
• XDR-software bruger AI til konstant at blive mere effektiv til at identificere nye og mere ondsindede stammer af malware
• Er god til selv at identificere trusler via endpoints, potentielt før de spredes gennem netværket.

SKAL JEG VÆLGE EN XDR- ELLER NDR LØSNING?

Der er virkelig ikke noget rigtigt svar her. Og som udgangspunkt vil vi altid anbefale at i snakker med en ekspert, for at de kan forstå jeres behov bedst muligt.

Virksomheder vil finde værdi i begge løsningerne alene, men dem der virkelig bekymrer sig om at beskytte deres virksomhed mod cybertrusler, bør undersøge holistiske strategier, som ikke kun omfatter én, men både XDR- og NDR-løsninger. Årsagen til dette er, at cybertrusler kommer i en bred vifte af former og størrelser, og én enkel løsning vil ikke være nok til at forhindre, at hver enkelte type cybertrussel ikke kan få adgang til din data og forretningsdrift.

Du bør lede efter en NDR-løsning, der giver synlighed over hele dit netværk. Da mange virksomheder vender sig mod cloud-baserede tjenester, er dette af største vigtighed – og du skal sikre dig, at NDR-løsningen er fuldstændig kompatibel med alle cloud-tjenester, du bruger.

Med hensyn til XDR-løsninger, find en, der fungerer godt sammen med dine andre cybersikkerheds løsninger. Vi anbefaler at man som virksomheder, bliver fremadtænkende og derfor forbereder sig på selv de mest avanceret cybertrusler. Find de løsninger, der arbejder problemfrit i tandem for at dække alle virksomhedens svage punkter.

SentinelOne Expands Firewall and NDR Capabilities

Leading XDR platform announces integrations with key industry players, taking network security to new heights

MOUNTAIN VIEW, Calif., April 13, 2023–(BUSINESS WIRE)–The increasing complexity of distributed networks and remote workforces has made network visibility more challenging than ever for companies to gain. SentinelOne (NYSE: S), is making it easier. The autonomous cybersecurity platform company and leading XDR platform today announced integrations with key industry players Aruba, Checkpoint, Cisco, Darktrace, Extrahop, Fortinet, Palo Alto Networks and an enhanced collaboration with Vectra AI which expand the company’s firewall and network detection and response (NDR) capabilities, and will allow organizations of all sizes to gain the insights they need to rapidly identify and respond to attacks across all vectors.

“The integration of firewalls and NDR capabilities perfectly complements our XDR solutions,” said Akhil Kapoor, Vice President, Technology Partnerships, SentinelOne. “In expanding our world-class partner ecosystem, we can deliver purpose-built, joint solutions that provide the complete and accurate view companies need to push their security posture to new heights and protect against tomorrow’s threats today.”

Enriched Signal Analysis with Vectra AI
By incorporating additional context from Vectra AI into the SentinelOne Singularity™ XDR platform, security operations teams can make better-informed decisions during incident triage and investigation. SentinelOne channels correlated alert data from Vectra AI into its XDR feed, offering enriched context for security analysts. This enhanced alert data enables analysts to assess the scope of an incident, evaluate its severity, and prioritize remediation efforts, ultimately reducing mean time to response (MTTR).

“We are thrilled to announce our new partnership with SentinelOne,” said Kevin Kennedy, SVP Product, Vectra AI. “By joining forces, we can provide the best attack signal for enterprise SOC teams by combining endpoint and network telemetry. This new partnership enables customers to achieve greater speed in investigation and triage, as well as more reliable visibility into unknown threats.”

Log Ingestion with Aruba, Checkpoint, Cisco, Darktrace, ExtraHop, Fortinet, and Palo Alto Networks

While NDR solutions are critical to limiting lateral movement, firewalls are key to preventing initial infiltrations. SentinelOne’s integrations with Cisco, ExtraHop, Fortinet, and Palo Alto Networks allows its XDR platform to detect network-borne threats and attack techniques like command and control (C2) beaconing and data exfiltration. With effective network security and the telemetry SentinelOne automatically collects and delivers from cloud and endpoints, customers can identify suspicious behavior or potential threats that could have gone undetected.

“At Cisco, we are excited to announce our new integration with SentinelOne,” said Jessica Bair Oppenheimer, director of strategic alliances, Security Business Group at Cisco. “Combining the power of the Singularity Platform with Cisco’s leading firewall and access management solutions will mean superior protection for joint customers. Working together, we are creating a more secure digital future for everyone.”

All integrations are available today via SentinelOne’s Singularity Marketplace. To learn more about SentinelOne’s partner ecosystem and the trusted and validated solutions that can be layered across your security stack to deliver premium protection, click here.

Released May 25, 2022, MITRE Engenuity ATT&CK® Evaluation Trials – Deception is an inaugural evaluation that expands the ATT&CK Evaluations landscape to evaluate vendors on their deception capabilities. The evaluation can dramatically increase analyst confidence in detection via high fidelity tripwires, causing the adversary to waste time, money, or capability, and potentially provide vendors critical new insights into adversary behavior.

What Did the ATT&CK Deception Evaluation Consist Of?

For this evaluation, MITRE chose to emulate APT29 threat group. APT29 is a threat group that has been attributed to the Russian government and has operated since at least 2008. This group reportedly compromised the Democratic National Committee starting in the summer of 2015. The evaluation seeks to answer two questions:

1. Did the adversary encounter the deception ? (Observe)
2. Did the adversary engage in the deception? (Engage)

• Observe: Determining whether the adversary encountered deception is pretty straightforward. The evaluation can determine by running the adversary technique and recording whether it sees something different from a scenario that did not deploy deception. For the Observe portion of the evaluation, the MITRE Engenuity team did not interact with the Deception.
• Engage: In order to fully capture the value of the vendor participants’ products, the MITRE Engenuity team executed a modified scripted plan that allowed deeper interaction with the deceptions. In the Engage portion of the Evaluation, the red team would go off-script and interact with deception if it was present. When the red team engaged, they would exhaust all interactions before going back to the script.

How Did SentinelOne Perform on the ATT&CK Deception Evaluation?

As evidenced from the results of all four years of the ATT&CK Enterprise Evaluations, SentinelOne Singularity XDR platform already excels at visibility and detection. With SentinelOne’s Hologram deception solution tested in this evaluation, SentinelOne also protects the enterprise against sophisticated Identity-based attacks.

According to MITRE Engenuity’s published results, SentinelOne observed and/or engaged with most detections, identifying 17 unique techniques, including 11 techniques that targeted identities specifically. SentinelOne’s Singularity XDR platform – and specifically its Hologram deception technology – was recognized for its ability to:

1. Deliver Real-time Protection Against Active Directory (AD) Compromise.
   A security compromise of AD can essentially undermine the integrity of the entire enterprise enabling adversaries to steal credentials and gain access to critical systems. 
   SentinelOne protects AD privileged credentials from theft by hiding them from attackers and replacing them with decoys. During the MITRE Deception evaluation, when the MITRE red team tried to get access to the system to get account information and credentials (T1033 T1082 T1087), the solution returned decoy credentials to them every time.

   

   This enables the security team to protect in real-time against advanced attacks targeting Active Directory.

2. Mislead Attackers To Protect Critical Assets With Data Cloaking.Attackers steal and destroy information as part of their attacks, whether they seek to move deeper into the network or hold data for ransom. Preventing them from seeing or accessing local file and account information can prevent lateral movement, discovery, and data theft or destruction.
   SentinelOne steers adversaries away by misdirection, showing decoys indistinguishable from production assets. During the MITRE Deception evaluation, when the red team tried to monitor system activity and queried for the computer name, SentinelOne reported decoy hostname “Newburgh” instead of the actual hostname “Utica” (T1082). When the red team tried to manipulate the software and engage with the file by browsing to it, SentinelOne hid the file from the directory listing (T1560).

   

   

    

   By preventing attackers from seeing or exploiting critical data, organizations can disrupt discovery or lateral movement activities and limit the damage from ransomware attacks.

3. Stop Lateral Movement and Privilege Escalation By Preventing Pass-The-Ticket Attacks.Pass-The-Ticket attacks, such as a Golden Ticket attack or a Silver Ticket Attack, are powerful techniques adversaries employ for post-exploitation lateral movements and privilege escalation. Using these techniques, attackers can gain unlimited access to any endpoint on the network or service, potentially causing catastrophic consequences.
   During the MITRE Deception Evaluation, when the red team created a ticket, the terminal output of klist reported no cached tickets. SentinelOne detected a Kerberos attack, and hid the contents of the klist command from the output (T1550).

   

   SentinelOne denies the red team from using the Golden Ticket, even though Mimikatz generated and loaded it successfully. SentinelOne detects forged Kerberos Golden and Silver tickets and prevents lateral movement and privilege escalation when the red team uses the forged Kerberos tickets.

4. Maximize Security Insight Into the Adversary Behavior.
   SentinelOne’s deception technology not only serves to detect and respond to active attackers in a customer environment but also to inform and strengthen security programs in the longer term. By misdirecting attacks using SentinelOne, defenders can gain ingestible, actionable TTP information and high-confidence, substantiated attack forensics that can support investigations and develop threat intelligence. SentinelOne even lets you visualize attacks, see how they progressed over time, and map their associated events to the MITRE ATT&CK D3FEND™ matrix.

Mapping to MITRE Engage Matrix

The MITRE Engage Matrix is a framework for planning and discussing adversary engagement operations that empower organizations to engage their adversaries and achieve their cybersecurity goals. MITRE Engage seeks to help defenders by lowering the barrier to entry while raising the ceiling of expertise to use adversary engagement technologies. SentinelOne provides the most extensive capabilities to implement the activities outlined in the Engage Matrix, covering 38 of the 41 areas in the Operations phase.

Why SentinelOne? Why Should It Matter To You?

Top Coverage for Both Enterprise ATT&CK + Deception ATT&CK Frameworks

As a leader across MITRE Enterprise ATT&CK Evaluations for the third consecutive year and a leader in the inaugural MITRE ATT&CK Deception Evaluation Trial, SentinelOne once again demonstrate its commitment to push the boundaries to help enterprises gain control of their dynamic attack surface.

As the first and only XDR vendor to participate and lead the ATT&CK Deception Evaluation, Singularity XDR platform demonstrates the most powerful, autonomous XDR platform, reducing the enterprise attack surface across human, device, and cloud attack surfaces. The solution provides an effective combination of prevention, protection, detection, and deception capabilities to stop attackers early whether they are attempting to establish a beachhead inside the network or compromising identity data to move laterally, escalate privileges, and acquire targets.

SentinelOne is an enthusiastic supporter of what MITRE does, bringing transparent and open evaluation methodologies to the security industry and participating in all the evaluations has become an essential practice that we have used to improve our products further.

To learn more about SentinelOne’s results on the ATT&CK® Deception Evaluations, visit https://www.sentinelone.com/lp/mitre-deception/

To learn more about SentinelOne’s results on the fourth round of ATT&CK® Enterprise Evaluations, visit: https://www.sentinelone.com/lp/mitre/.