Full Report
Most NDR deployments focus on perimeter traffic. Meanwhile, attackers move laterally inside networks. Here’s why east-west visibility is the blind spot that defines today’s biggest breaches.
Analysis Summary
# Best Practices: Network Detection and Response (NDR) for East-West Visibility
## Overview
These practices address the critical "blind spot" in modern cybersecurity: internal (east-west) network traffic. While traditional security focuses on the perimeter (north-south), attackers spend the majority of their time moving laterally within the network. These guidelines help organizations detect internal movement, lateral transitions, and sophisticated attacks that bypass initial boundary defenses.
## Key Recommendations
### Immediate Actions
1. **Conduct a Visibility Audit:** Map your network to identify where traffic is currently monitored and where blind spots exist, specifically between internal segments and VLANs.
2. **Evaluate Current NDR Placement:** Assess if your existing NDR sensors are limited to the perimeter (ingress/egress) and prioritize moving or adding sensors to internal switches.
3. **Enable Protocol Analysis:** Ensure monitoring is active for common lateral movement protocols such as SMB, RDP, RPC, and Kerberos.
### Short-term Improvements (1-3 months)
1. **Deploy Internal Traffic Sensors:** Transition from simple perimeter monitoring to internal traffic sniffing by configuring SPAN ports or TAPs on core and distribution switches.
2. **Integrate Threat Intelligence (TI):** Connect your NDR to a real-time TI feed to automatically enrich internal detections with context regarding known malware families and threat actor groups.
3. **Establish Baseline Behavioral Profiles:** Start a learning period to define "normal" internal traffic patterns (e.g., typical admin RDP usage) to reduce false positives for behavioral anomalies.
### Long-term Strategy (3+ months)
1. **IT/OT Convergence:** Extend NDR visibility into Operational Technology (OT) and ICS/IIoT environments using industrial-specific protocols (MQTT, Modbus, DNP3).
2. **Full-Packet Inspection Implementation:** Shift from metadata-only analysis to deep packet inspection (L2-L7) to detect hidden threats within legitimate communication channels.
3. **Managed XDR Integration:** Incorporate NDR data into a 24/7 Managed eXtended Detection and Response (MXDR) framework to ensure around-the-clock expert analysis of internal threats.
## Implementation Guidance
### For Small Organizations
- **Focus on High-Value Assets:** Deploy sensors primarily around sensitive data stores or servers containing PII.
- **Leverage Managed Services:** Utilize a Managed NDR or XDR provider to handle the heavy lifting of alert analysis, as internal staffing for 24/7 monitoring is usually unavailable.
### For Medium Organizations
- **VLAN Segmentation Monitoring:** Ensure that traffic moving between different departments (e.g., Marketing to Finance) is inspected.
- **Contextual Enrichment:** Prioritize solutions that offer automatic attribution to help small security teams understand the "why" behind an alert.
### For Large Enterprises
- **Comprehensive Protocol Support:** Ensure the NDR can handle high-throughput traffic and a vast array of protocols, including legacy and specialized industrial (OT) protocols.
- **Global Visibility:** Deploy a unified platform that aggregates internal traffic data from multiple geographical sites and cloud environments into a single dashboard.
## Configuration Examples
While specific code depends on the vendor, the following conceptual configurations are essential:
- **Switch Port Analyzer (SPAN):** Configure core switches to mirror traffic from all internal VLANs to the NDR sensor.
- **OT Protocol Support:** Configure the sensor to parse industrial protocols:
- *Example Port Monitoring:* Port 502 (Modbus), Port 1883 (MQTT), Port 20000 (DNP3).
- **Encrypted Traffic Analysis:** Enable fingerprinting (like JA3/JA3S) to identify malicious traffic patterns within encrypted tunnels without needing full decryption.
## Compliance Alignment
- **NIST Cybersecurity Framework (CSF):** Aligns with "Detect" (DE.AE) and "Respond" (RS.AN) functions.
- **ISO/IEC 27001:** Supports Annex A controls regarding network security and monitoring (A.12.2.1, A.13.1.1).
- **CIS Controls:** Directly maps to Control 8 (Audit Log Management) and Control 13 (Network Monitoring and Defense).
## Common Pitfalls to Avoid
- **Perimeter Obsession:** Believing that a strong firewall and perimeter NDR is sufficient; attackers almost always gain initial access through legitimate means (phishing, stolen credentials).
- **Ignoring OT Environments:** Treating the IT network and the production/industrial network as separate silos, leaving the OT side unmonitored.
- **Metadata Over-reliance:** Relying only on NetFlow or metadata, which may miss sophisticated payloads hidden in legitimate protocols.
- **Alert Fatigue:** Deploying NDR without a plan for 24/7 analysis, leading to critical internal movement alerts being missed in a sea of data.
## Resources
- **Group-IB Unified Risk Platform:** [https://www.group-ib[.]com/products/unified-risk-platform/]
- **Network Protection Assessment Tool:** [https://trebuchet[.]gibthf[.]com/?tab=network]
- **MITRE ATT&CK Matrix for Enterprise:** [https://attack[.]mitre[.]org/] (Use to map lateral movement techniques detected by NDR).