Trend Micro Network Security

What is Trend Micro Network Security?

Trend Micro Network Security is a network threat detection and response (NDR) solution that provides network traffic visibility and attack protection. It is integrated with the Trend Vision One platform.

Key differentiators:

• NDR + IPS - detection and blocking in one
• Encrypted Traffic Analysis - encrypted traffic analysis without decryption
• XDR correlation - correlation with endpoint, email, and cloud
• Network forensics - full visibility for incident analysis

Solution Architecture

graph TB
    subgraph "Network Traffic"
        A[Internet] --> B[Perimeter]
        C[Internal] --> D[Core Switch]
        E[Data Center] --> F[Server Segment]
    end

    subgraph "Trend Network Security"
        G[Network Sensor]
        H[Deep Packet Inspection]
        I[Behavioral Analysis]
        J[Threat Intelligence]
    end

    subgraph "Response"
        K[Alert]
        L[Block]
        M[Quarantine]
    end

    B --> G
    D --> G
    F --> G
    G --> H --> I --> J
    J --> K
    J --> L
    J --> M

Protection Features

Network Detection & Response (NDR)

Network traffic threat detection:

• Behavioral analysis - network behavior anomaly detection
• Machine learning - ML models for unknown threats
• Protocol analysis - deep protocol analysis
• Metadata extraction - metadata extraction for analysis

Intrusion Prevention System (IPS)

Network attack blocking:

• Signature-based - known exploit detection
• Zero-day protection - virtual patching
• Protocol anomaly - protocol irregularity detection
• DoS/DDoS protection - DoS attack protection

Encrypted Traffic Analysis

Encrypted traffic analysis:

• TLS inspection - optional TLS decryption
• Behavioral analysis - analysis without decryption
• JA3/JA3S fingerprinting - TLS connection fingerprinting
• Certificate analysis - certificate analysis

Lateral Movement Detection

Lateral movement detection:

• East-West traffic - internal traffic monitoring
• Credential abuse - credential abuse detection
• Protocol tunneling - tunneling detection
• Data exfiltration - data leak detection

Deployment Models

Inline (IPS Mode)

• Active threat blocking
• Inline placement in traffic path
• Highest protection level

Passive (TAP/SPAN)

• Monitoring without traffic impact
• Traffic copying via TAP or SPAN
• Ideal for pilot or audit

Hybrid

• Combination of inline and passive
• Different modes for different segments
• Deployment flexibility

Integration with Trend Vision One

Network Security as part of Vision One:

[Network Detection] ----+
                        |
[Endpoint Detection] ---+--> [XDR Correlation] --> [Unified Alert]
                        |
[Email Detection] ------+
                        |
[Cloud Detection] ------+

XDR Benefits:

• Event correlation from multiple layers
• Full attack chain visibility
• Automatic cross-domain response
• Single view of all incidents

Detection Scenarios

Ransomware Attack Chain

1. Phishing email → Email Security detects
2. Malware download → Network Security blocks C2
3. Lateral movement → NDR detects lateral movement
4. Data exfiltration → Exfiltration blocking

Advanced Persistent Threat (APT)

1. Initial access → exploit detection
2. C2 communication → beaconing blocking
3. Internal reconnaissance → scan detection
4. Data staging → data aggregation alert

Who is it for?

Trend Micro Network Security is for organizations that:

• Need network traffic visibility
• Want to detect lateral movement and APT
• Require IPS for inline protection
• Seek XDR integration with endpoint and cloud

Deployment with nFlo

1. Network Assessment - network architecture analysis
2. Sensor Placement - sensor location planning
3. Deployment - sensor installation (inline or passive)
4. Baseline - learning normal network behavior
5. Policy Tuning - IPS policy adjustment
6. XDR Integration - connection with Vision One