0

Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution?

I've been trying to do research on this, but are struggling to find good sources comparing the two together, or even discussing them within the same context. There seems to be a lot of hype around EDR, but intuitively I would think there would additional advantages in also monitoring traffic before it hits endpoints. Especially considering a scenario where some endpoints within a network doesn't have a EDR-client installed (like IoT devices for example).

Does anyone have some knowledge about this topic? Or know of any good resources I can look into?

Improve this question
2
  • Can you put EDR solutions on all your endpoints? Would you like to reduce the number of threats your EDR needs to tackle?
    – schroeder ♦
    Feb 4, 2021 at 10:54
  • Some endpoints will remain without an EDR client. Reducing the number of threats for the EDR to tackle would be good. I'm also curious about whether a NIDS would be better suited for dealing with some kind of threats than EDR, making the extra overhead worth it. Thank you for responding!
    – Grenair
    Feb 4, 2021 at 11:06

1 Answer 1

Reset to default
1

I don't think the discussion needs to be about IDS and EDR specifically. The concept you are going for is called "defense-in-depth", or the Reason Model (a.k.a. the Swiss Cheese model).

enter image description here

There is no perfect defense, so layering defenses helps to reduce how successful a threat is at causing loss.

And EDR and NIDS can have different scopes.

  • If NIDS is just on the perimeter, then you still need EDR for host-to-host threats
  • If EDR cannot be placed everywhere, then NIDS is required for common defense

It's not about if one is better than the other. There is no "silver bullet". It's about the threats and your risks and finding the optimal controls to counter threats and lower your risks.

So,

Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?

Yes. Quite simply, if the EDR solution does not lower your risks acceptably in your context.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .