NG-IDS, NDR, and ExtraHop

Network complexity. Corporate networks now extend to multiple public cloud providers, carrier networks, and even consumer Wi-Fi devices used by remote workers. Somehow, the security and IT team must secure and monitor all traffic to prevent, detect, and respond to network-based cyber-attacks.

The dangerous threat landscape. Organizations face unprecedented cyber-threats, from phishing, to ransomware, to cyber-supply chain interdiction. In fact, attackers have modified their strategies, using social engineering techniques against human targets rather than rely on exploiting software vulnerabilities as they did in the past. Network security plays an essential role in detecting these threats, but this has become more difficult due to their volume and sophistication.

A growing attack surface. Over the past 2 years, most organizations have moved workloads to the cloud, embraced SaaS applications, deployed IoT devices, and increased the population of remote employees. Overwhelmed security teams must further extend resources to protect this growing attack surface.

High efficacy: Security operations teams don’t have the time or resources to sort through logs or triage voluminous security alerts from noisy network security tools. Rather, network security technology must be able to accurately detect threats in real time across the enterprise and throughout the attack kill chain.

Operational efficiency. Overburdened security teams can’t scale operations when network security is based on individual network security tools requiring training, complex deployment, system tuning, and ongoing administration. Henceforth, independent network security systems must be designed to support security operations processes like forensic investigations, threat hunting, incident response, process automation, etc. This is an important change that emphasizes global security operations rather than each security technology.

Tight integration. Given the growing attack surface and distributed network, it’s not surprising that security teams strive for interoperability amongst all network security technologies. In fact, 84% of organizations say that they are very active or somewhat active with efforts to integrate disparate security analytics and operations tools to form a more cohesive security software architecture.³

Minimize dwell time. Network security technology must provide detection-in-depth to identify different types of attacks (i.e., phishing, cyber-supply chain attacks, stolen credentials, etc.) regardless of their location or phase of the kill chain. The goal? Greatly reduce mean-time-to-detect (MTTD) and mean-time-to-respond (MTTR) cyber-attacks before any real damage is done. To accomplish this, network security technologies must also help security teams operationalize the MITRE ATT&CK framework.

End-to-end coverage. Beyond the perimeter, NG-IDS should be present to inspect traffic across the network (in data centers, public clouds, on the internal network, etc.), so it can continually monitor north/south AND east/west traffic. In addition, NG-IDS also accommodates encrypted traffic inspection, pinpoints and reports on network hygiene issues, captures packets for detailed investigations, and works with malware sandboxes to collect and inspect file payloads for malicious payloads.

Improved threat detection accuracy. Threat detection must extend past signatures and basic heuristics, using modern technologies like machine learning algorithms, predictive models, continuous content updates based on threat research, and cloud-scale analytics. The goal here is to bolster threat detection efficacy and accuracy, allowing analysts to prioritize investigation and remediation actions. To support forensic investigations, NG-IDS retains network security metadata for at least 90 days while providing the right dashboards and interfaces for junior and experienced security analysts from a single interface.

Contextual alerting. Aside from accurate detection of individual security events, SOC teams want to associate individual events to detect and understand cyber-attacks as they progress across a cyber-kill chain. This requires an ability to correlate and contextualize security events and then view them with an understanding of network traffic behavior, threat intelligence, and attack patterns. The focus here is on breach prevention rather than security alerts alone. Therefore, NG-IDS must be designed to piece together attacker TTPs, not just discrete rules violations. To maximize value, NG-IDS also supports the MITRE ATT&CK Framework.

Security operations affinity. NG-IDS is designed for out-of-the-box integration with security technologies and operational processes. For example, NG-IDS ingests data from different sources like cloud infrastructure and threat intelligence to be able to have perspective on network security events. NG-IDS also integrates with other analytics solutions like SIEM systems, feeding them high-fidelity alerts for further investigation. To streamline security operations, NG-IDS interoperates with IT infrastructure solutions, SOAR platforms, and IT operations case management systems. In aggregate, NG-IDS supplements, enhances, and accelerates existing technologies and processes.

Eliminate blind spots across the enterprise. Reveal(x) is a cloud-native NDR platform that can take advantage of cloud scale, storage, and analytics capabilities, providing east/west traffic visibility and encrypted traffic inspection. For full coverage, ExtraHop NDR also discovers and classifies every transaction, session, device, and asset at up to 100Gbps, decoding over 70 enterprise protocols.

Modernize threat detection. ExtraHop goes beyond traditional IDS signature and heuristic threat detection with machine learning across 5,000 different network metadata features, leading to more than one million different predictive models per site. ExtraHop supports these models with continuous updates based on emerging threat intelligence and research.

Contextualize alerts and accelerate investigations. Reveal(x) contextualizes detections from an entire transaction with threat intelligence, risk scores, and asset criticality. The goal here is to provide analysts with accurate, actionable, high-fidelity alerts rather than security alerts related to individual anomalies and events.

Streamline security operations. Reveal(x) provides visualizations and dashboards for detection and investigation on its own. Reveal(x) can be combined with solutions like CrowdStrike, Splunk SIEM/SOAR, and Palo Alto Networks for security operations orchestration and automation of response and containment actions.

Start fast with SaaS-based security. Reveal(x) 360 takes a SaaS-based approach to delivering NG-IDS capabilities for hybrid and multi-cloud deployments. Organizations can deploy Reveal(x) 360 sensor to on-premises and cloud environments and gain unified visibility from a single detection and response service platform.