NDR, why the network is the vantage point that unites IT and OT

Almost every cyber attack has to cross the network sooner or later. Ransomware explores servers before encrypting them, data thieves have to move data out, and anyone targeting an industrial plant usually gets in through the office and then looks for a route to the factory. That is why the network is the most complete vantage point a company has, and also the one that connects the IT world to the OT world.

NDR (Network Detection and Response) is designed to exploit exactly this advantage, because it analyses traffic to recognise suspicious behaviour and makes it possible to act before damage is done.

What NDR is

An NDR solution receives a copy of network traffic through switch mirroring ports or TAP devices, so it listens without interfering. From the traffic it works out who talks to whom, with which protocols, at what times and in what volumes, and over time it builds a model of the normal behaviour of every device.

When something deviates from this model, such as a computer that starts querying dozens of servers, an unusual data transfer to the outside, or a write command sent to a PLC from a workstation that has never done so, NDR raises an alert with the context needed to understand it. The response part consists of connecting to firewalls, network access control systems and SOC tools to isolate a device or block a communication.

Why the endpoint is not enough

Tools installed on computers, such as EDR, are essential but only see the devices they run on. Every network contains many things that cannot host an agent, for example printers, cameras, network devices, IoT devices, systems managed by external suppliers and, above all, PLCs, HMIs and industrial controllers.

This is why people often talk about a visibility triad, in which SIEM, EDR and NDR complement each other. The SIEM collects and correlates logs, EDR protects individual endpoints, and NDR observes everything that crosses the network, including devices that produce no logs and host no agents.

What NDR sees in the IT network

• Lateral movement, that is, an attacker who has compromised one computer exploring the network and trying to reach other systems.
• The stages before a ransomware attack, such as reconnaissance of servers and network shares, which often last days before encryption.
• Communication with command-and-control servers, even when hidden in apparently legitimate traffic.
• Data exfiltration, with volumes or destinations that are unusual compared with normal behaviour.
• Unknown devices connected to the network, including personal or unauthorised ones.

Even encrypted traffic, which is now the majority, is not an insurmountable obstacle. NDR can analyse its characteristics, such as session duration, packet sizes and certificate fingerprints, to recognise suspicious behaviour without having to decrypt it.

What NDR sees in the OT network

In industrial plants NDR is often the only way to gain visibility without touching production systems. Listening is completely passive, so it adds no latency and does not risk stopping a line.

• Automatic asset inventory, with the make, model and firmware version of PLCs, HMIs and other devices derived from the traffic itself.
• Understanding of industrial protocols such as Modbus TCP, S7comm, PROFINET, OPC UA, EtherNet/IP, DNP3 and IEC 60870-5-104, down to the individual command.
• Critical commands out of the ordinary, for example uploading a new program to a PLC, changing an operating mode or an unplanned firmware update.
• New connections between zones that should not communicate, a sign of a misconfiguration or unauthorised access.
• Known vulnerabilities associated with the devices identified, useful for setting intervention priorities.

There is also a natural advantage. OT traffic is far more repetitive and predictable than IT traffic, so a deviation from normal behaviour stands out very clearly and with few false positives.

The cross-cutting network, where IT and OT meet

Many incidents in industrial plants do not start on the factory floor but in the corporate network, with a phishing email, a poorly protected remote access or a compromised computer that has a connection to the production area. The most sensitive point is therefore the boundary zone between IT and OT, that is, the industrial DMZ and the conduits between zones defined by IEC 62443.

An NDR that observes both worlds, and above all the passage between them, makes it possible to follow an attack along its whole path. You can see the first compromised computer in the office, the attempt to reach the server that bridges to the plant and finally any anomalous command sent to a controller. If IT and OT are monitored with separate tools and by different teams, these signals stay disconnected and the attack risks being recognised only when it produces its effects.

A single view also helps meet NIS2 obligations on incident detection and handling, and verify that the segmentation designed according to IEC 62443 is actually respected over time.

What to look for in an NDR solution

• Passive sensors that can be installed both in data centres and in plant cabinets.
• Coverage of IT and industrial protocols in the same platform.
• Behavioural analysis based on learning what is normal, combined with up-to-date threat intelligence.
• Analysis of encrypted traffic without the need to decrypt it.
• Asset inventory linked to known vulnerabilities.
• Integration with SIEM, firewalls and network access control, so that the response is fast and coordinated.
• Retention of traffic metadata for a period suitable for investigations.

How to introduce it

1. Map the main flows and choose the observation points, such as the network core, the industrial DMZ and the conduits between zones.
2. Start in observation-only mode, giving the system a few weeks to learn normal behaviour.
3. Review alerts with the people who know the network and the plants, to remove noise and focus on what matters.
4. Connect NDR to the SOC, because an alert is only valuable if someone analyses it in time, even at night.
5. Define response procedures together with plant staff, avoiding automatic blocks in OT that could stop production without an assessment.

In short

NDR provides what other tools cannot, namely visibility into everything that communicates, including devices without agents and industrial systems. In a network where IT and OT are now connected, observing traffic across both is the most effective way to recognise an attack while it is moving, rather than when it is too late.

Our SOC monitors IT and OT networks around the clock. If you want to understand how visible your network is today, get in touch and we will start with an analysis of your flows and observation points.