The Importance of NDR Detection-in-Depth

The Importance of NDR Detection-in-Depth, published by SANS Institute in July 2023, argues that network detection and response (NDR) programs need multiple layered detection technologies, not a single mechanism, to reliably catch adversaries who can evade any one method. Written by Matt Bromiley, the paper applies the established "defense-in-depth" security concept to detection specifically, walking through five core NDR detection techniques and how they combine to close gaps that any single technique leaves open.

Key concepts and recommendations:

• Detection-in-depth means layering multiple NDR detection technologies so that adversaries who evade one or two mechanisms still get caught by another, rather than relying on a single point of detection
• The five core NDR detection techniques are indicators of compromise (IOCs), signatures, behavioral detection, supervised machine learning, and unsupervised machine learning, each with different tradeoffs in scope, time window, confidence level, and development effort
• IOCs (like known-bad IP addresses or domains) offer near-instant deployment and high confidence but are narrow and easy for attackers to evade by simply changing infrastructure
• Signature-based detection also deploys quickly and reliably catches known patterns, but like IOCs, it's narrow in scope and can miss novel attack techniques
• Behavioral detection operates over short-to-medium time windows and can identify both narrow and general malicious activity by comparing observed traffic against expected patterns
• Machine learning techniques (supervised and unsupervised) require the most development time, sometimes months of training data, but offer the broadest detection power against previously unseen threats
• Threat intelligence, while valuable, functions as a data source that enriches detection technologies rather than as a detection technique in its own right
• DNS protocol misuse, as seen in the 2020 SolarWinds attack, is difficult to catch with static indicators alone because DNS traffic volume is high and easily altered, making it a strong candidate for a layered detection-in-depth approach
• Adversary lateral movement using legitimate protocols like SMB or RDP blends into normal internal traffic, making a combination of signature, behavioral, and machine learning detection more effective than any single method
• Zero-day exploits evade basic indicator and signature detection since the vulnerability is unknown, making behavioral detection and machine learning the more effective stages for catching this attack type

The paper's core argument is that no single detection technology can catch every attacker, and organizations should stop looking for one "best" detection method. Layering IOCs, signatures, behavioral analysis, and machine learning together creates a "detection maze" where evading one layer still exposes the adversary to the next, extending the same logic that already governs defense-in-depth into the detection layer specifically.