Cyber defense in the industry: EDR vs. NDR

Industrial companies are faced with the challenge of protecting IT systems such as servers and databases while at the same time having to maintain operational technology (OT systems) such as industrial control systems (ICS), human-machine interfaces (HMI), SCADA and IoT devices. In particular, the fear that sensors and IoT devices can be hacked and the data manipulated is causing uncertainty. Where should protection start?

Practice shows that cyberattacks often start at the endpoints. A damaged laptop belonging to a maintenance technician with access to production networks can serve as a starting point for cyberattacks and trigger lateral movement in OT systems. The statistics also point in this direction: in 2023 alone, industrial companies accounted for around 25% of all reported security incidents. IT was the main attack vector - 72% of attacks came from there.

Why are industrial companies particularly affected? The main reason for this lies in the ever-increasing attack surfaces due to the networking of IT and OT, the particularly vulnerable legacy systems and the high degree of technological and operational connectivity. Production is highly dependent on continuous processes, and delays can have a serious impact on the supply chain. Attacks can cause business disruption with serious repercussions, which is why companies often pay ransoms to restore operations. But what is the most effective way to protect against these attacks?

Protect endpoints or networks?

When choosing a cyber security solution, industrial companies are often faced with the choice between "Endpoint Detection and Response" (EDR) and "Network Detection and Response" (NDR). EDR monitors activity on endpoints such as desktops, laptops and servers, where threats usually begin. NDR solutions, on the other hand, focus on analyzing network traffic to detect threats through anomalies in the information flow. NDR tools are particularly useful for network segmentation, detecting lateral traffic between IT and OT, and protecting machines that cannot run security software.

EDR and NDR both use continuous monitoring to detect malicious activity. Upon detection, an alert is triggered that contains all the information needed to respond. The goal of detection and response technologies is to detect and respond to a successful intrusion and contain the attack before any damage is done. But where should this happen - at the endpoint, in the network or both?

Behavior in the event of ransomware, phishing and supply chain attacks

The annually updated Enisa Threat Landscape (ETL) report shows that ransomware, phishing and supply chain attacks are among the biggest challenges for companies.

Ransomware attacks often start on endpoints through phishing or infected attachments. EDR detects bulk file encryption through file system monitoring and behavioral analysis and terminates the malicious processes. NDR, on the other hand, monitors unusual outbound traffic to command and control (C2) servers. If trusted software has been compromised, NDR can detect unusual communication patterns. However, without the context of endpoints, false positives may occur.