 |
» |
|
|
|
|
|
|
| Host intrusion detection is being deployed as part of a security solution to satisfy regulatory compliance requirements e.g. SOX, HIPPA, and CISP. For example, Campana has deployed HIDS to help comply with PCI standards, while Menlo Worldwide has deployed HIDS to help satisfy SOX requirements. |
|
|
|
|
Host intrusion detection complements other security policies and systems you have in place. If you think of firewalls as fences with gates to let authorized personnel in, host intrusion detection is the video surveillance and burglar alarm systems that are set off when someone scales the fence or crashes the gate, and is now intent on capturing the central control system. In fact, the major threats are already inside, lurking and plotting the overthrow of your operating system and applications.
|
|
|
|
|
|
HIDS concentrates on protecting the HP-UX 11i operating environment from attacks by insiders, as well as from attacks initiated by outsiders that can not be detected or prevented by network intrusion detection systems (NIDS), that monitor network traffic on your perimeter. An FBI survey reports that insider attacks are about as common as outsider attack, supporting the claim that HIDS is absolutely necessary to fully protect mission-critical servers.
|
|
|
|
|
|
HP is in the best position to know the possible intrusion routes and take action upon the high-quality kernel audit data of the operating system. Third-party vendors are unable to integrate detection in the kernel the way HP does to offer the most complete analysis and detection.
|
|
|
|
|
|
HP has adopted a different approach to intrusion detection. HP detection templates guard and focus on areas vulnerable to attack. These are the areas in HP-UX 11i (as in any operating system) that intruders probe and try to exploit. When a profiled event is detected, it is passed to a correlation engine, that determines whether vulnerability is being exploited. This unique and sophisticated approach to intrusion detection recognizes most current attack scenarios and some future attacks yet to be invented.
|
|
|
|
|
|
HIDS monitors for the exploitation of the following vulnerabilities to detect attacks or misuse:
Vulnerability: Poorly written privileged programs
HIDS monitors: Buffer overflows and race conditions
Vulnerability: Unauthorized File Modification
HIDS monitors: Critical system and application programs and
Configuration files
System and application log files
File additions and deletion
Critical files made world writable
Privileged "setuid" programs created
Files modified by non-owners
Vulnerability: Weak password or unauthorized access
HIDS monitors: Logins/Logouts
Vulnerability: Password guessing
HIDS monitors: Failed logins and failed su attempts
|
|
|
|
|
|
|
| Intrusions are detected as they occur and alerts are provided immediately. Alerts are logged to the Alert Browser in color, based on three levels of severity. Alerts provide detailed information about what triggered the alert. For example, an alert for the unauthorized modification of a critical file includes the attributes of the critical file (full pathname, inode, owner, type, mode, device), the pathname of the program that triggered the alert, as well as the user ID, group ID, process ID, and parent process ID associated with the execution of the program. An alert triggered by a successful login contains the name and IP address of the remote host from which the login was made, as well as the pseudo device associated with the login session. This is helpful in identifying attackers for action based on security policy. Alerts are also written to a local log file for archiving and to allow the Administrative GUI to retrieve missed alerts that were generated when it was either not running or could not connect to HIDS sensors on the monitored host(s). |
|
|
|
|
|
|
The system can also be integrated with HP OpenView Operations (OVO) by using the smart plug-in for HIDS. OVO templates are used to monitor important log files, vital processes and near real-time alerts. OVO: - Reports the overall availability of the HIDS applications
- Uses an application bank to configure and manage the software.
- Provides for role-based monitoring and administration based on user profiles.
|
|
|
|
|
|
|
As soon as the HIDS application is installed, it immediately provides intrusion detection. HIDS provides pre-configured detection templates, surveillance groups, and surveillance schedules. You will want to tailor these to your operating environment, but basic detection and alerting are available immediately.
|
|
|
|
|
|
Data sources monitored by HIDS on the host include: - Kernel audit data that is generated by an audit system specifically designed for HIDS.
- System log files containing records for login (ssh, ftp, telnet, rlogin, etc.,....), logout, and switch-user (su) sessions, as well as for unsuccessful login and su attempts.
Communication between the Administrative GUI and the HIDS sensors on the monitored hosts is secured, both for integrity and privacy, using the Secure Socket Layer (SSL) protocol. |
|
|
|
|
Printable version
