Advanced Detection & response (AD&R)
What is AD&R?
- AD&R is a rapid evolution of traditional detection and response measures hugely challenged by quickly changing attackers’ techniques, the growing threat from APTs to the public but also private sectors.
- Modern AD&R has elements in all the five NIST cybersecurity Framework Functions (Identify, Protect, Detect, Respond, Recover).
Why it matters
- The proliferation of digital enterprise has opened up many vectors for cybercriminals to attack, including network, end points, cloud, OT, IOT.
- Fast growth of e-crime and the advancement of attacker tooling has made it easy to launch advanced attacks. Successful evasion of preventive controls is a matter of when and not if.
Convergence of multiple monitoring technologies into overarching platforms
It enables extended multi-vector visibility and control, including Endpoint based detection and response (EDR), Network traffic analysis (NTA), Cloud analytics
and more. On the functional side, use case-based correlation or
behavioral analysis are no more separate functions in the SOC, but rather one of multiple ways a
single platform or service mines every dataset to capture maximum indicators of threat.
AI is currently being proven on single modules and functions before envisaging a full AI-driven autonomous/cognitive monitoring and response.
AI will also bring intuitiveness to the way the SOC platform is interacted with by the analysts, threat hunters and security managers. AI is expected to enable cognitive detection & response using developments in Artificial General Intelligence before the end of this decade.
The future has much more to bring mainly in the area of:
Data analytics tooling “commoditization” : expertise development in this area will continue to enable situational awareness far beyond the one offered by legacy logic-based rules and signatures combined with low volume and not scalable monitoring solutions. Growing maturity in Red Teaming, threat simulation programs, use of deception technologies, threat hunting : all combined will further drive AD&R development with the end goal of staying in front of the attackers for a change.