Surviving the Mythos Era: Richard Bejtlich on the Case for NDR

Source Domain: thehackernews.com

Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What evidence do we have? How do we know we’re seeing it all, in context?

Answering these questions requires teams to go beyond alerts, the most common basis for initial triage. But investigations (and their outcomes) require defensible evidence, not assumptions, which is what alerts tend to offer.

Alerts are becoming less useful as vulnerability discovery accelerates (a.k.a., the Mythos Era). Most organizations can’t investigate the volume of new findings with existing workflows. Even with increased automation, SecOps teams need validated evidence of active exploit and exposure, not more raw telemetry.

As AI expedites both attacks and defense, security teams need to lay the groundwork that allows them to validate findings, understand attacker behavior, and stop suspicious traffic before it results in a breach.

Richard Bejtlich’s NDR Essentials: A Practical Guide to Network Detection and Response, published in partnership with Corelight, explores how network detection and response (NDR) helps practitioners navigate the current era of networking. The free guide is an introduction to NDR and a practical resource for teams looking to strengthen threat hunting and AI-assisted investigations.

The case for network interdiction

Many security programs focus on prevention. The reality is, though, that organizations can’t just shift left or shift right. Attention and control must be placed throughout the entire attack sequence.

If preventative controls were the simple answer, stolen credentials wouldn’t work once an attacker gains a foothold. Malware would be stopped at the perimeter. And data wouldn’t ever leave its storage environment.

Yet, these events occur all the time.

For these reasons, Bejtlich argues that resilient security programs should focus on interdiction:…

Source