Attacks happen. Despite your best efforts and despite multiple layers of prevention, attackers might find a way to infiltrate your network. Attackers might even be lurking in your network now. Once they gain a foothold, can you detect them before they steal your data or disrupt your business? The best way to detect active attacks is by analyzing network traffic for anomalies.
Attackers can enter the network through an infected laptop or a malicious USB drive. They can move around the network covertly and disable anti-virus software or turn off device logging. The only fail-safe way to capture all activity is to monitor all activity—not at the perimeter, but between end points and servers – on the network. By analyzing east-west and north-south traffic, LightCyber can pinpoint threats that would be difficult to detect any other way.
Every network and every user is unique. By profiling network activity, organizations can recognize changes in behavior that indicate an attack. With network analysis, organizations can profile the apps, the destinations, and the traffic patterns of every device to determine expected behavior and detect anomalies. By combining network-centric attack detection with agentless endpoint inspection and cloud intelligence, organizations can quickly identify and stop cyber security risks before the damage is done.
Log-based user behavior analytics (UBA) serves as an alternative approach to detect breaches. UBA platforms analyze log messages from cyber security devices and end points to identify threats such as brute force login and credential abuse.
While UBA solutions can analyze logs, they do not have visibility into network traffic or endpoint status. As a result, they cannot detect network anomalies, such as a normal user performing remote code execution or probing multiple network segments. They depend on third-party logs, which can be deleted or altered by attackers. And they always detect attacks after-the-fact, when log messages have been aggregated and analyzed, providing more time for attackers to steal or destroy data. To reduce the time to detection and to monitor all activity, organizations should deploy network traffic analytics.
Endpoint detection and response (EDR) solutions have emerged as a way to establish the timeline and the source of an intrusion. EDR solutions block known malware, detect the indicators of compromise, and aid in post-attack investigations.
Unfortunately, EDR solutions require organizations to install yet another agent on endpoints. As a result, many cannot monitor devices like printers, employee-owned tablets, mobile phones, and VoIP phones. They also cannot detect insider threats or identify lateral movement from compromised machines. And like logging and anti-virus software, they can be easily disabled by attackers. While EDR solutions provide a valuable service for investigating attacks once you know they’ve occurred, they do not deliver a complete solution for network attack detection.