RE: using HIDS for change control

From: Evans, Arian (Arian.Evans_at_fishnetsecurity.com)
Date: 08/25/05

  • Next message: Bob Walder: "Re: IPS technology question." 
    Date: Thu, 25 Aug 2005 09:44:42 -0500
To: "Rivera,Angel L." <ARIVERA@mitre.org>

    Angel,

    I used to use the Pentasafe "HIDS" for this but the
    Windows agents flat-out didn't work. NetIQ has I believe
    scrapped these agents and I don't know if they employ
    the same monitoring in the current line.

    Bindview had similar potential capabilities three years
    ago but I don't believe they had prebuilt "rules". This
    was similar to HP Openview ManageX agents. I haven't played
    with this for a few years so a lot may have changed.

    The answer bears strongly on your definition of "HIDS".
    On Windows you could use NetIQ's GPO/LPO monitor and
    if you configure f/s auditing properly on NTFS, monitor
    this though event-log parsers, or local agents (see above),
    or 'HIPS' like CSA.

    I know people using Tripwire and one gov that uses Entercept
    for "change control".

    So the answer is yes.

    It's really all in the definition of what "change control"
    and "change management" consist of I believe, though.

    'Change Management' has to be up there in the top 10 with
    'anomaly detection', 'behavioral analysis' and 'Application
    Security' for most equivocal terms used in infosec.

    Arian

    > -----Original Message-----
    > From: Rivera,Angel L. [mailto:ARIVERA@mitre.org]
    > Sent: Wednesday, August 24, 2005 5:10 PM
    > To: focus-ids@lists.securityfocus.com
    > Subject: RE: using HIDS for change control
    >
    > Does anyone on this list know of a sponsor that is using HIDS
    > to monitor
    > changes to a system's (Unix & Windows) configuration?
    >
    > The goal is to build a server according to specs (this would include
    > hardening of the OS + agency specific security settings) then
    > use a HIDS
    > to detect and alert on any changes.
    >
    > Theoretically speaking, I know this can be done, but is anyone doing
    > this?
    >
    > --------------------------------------------------------------
    > ----------
    > Test Your IDS
    >
    > Is your IDS deployed correctly?
    > Find out quickly and easily by testing it
    > with real-world attacks from CORE IMPACT.
    > Go to
    > http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    > to learn more.
    > --------------------------------------------------------------
    > ----------
    >
    >

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

  • Next message: Bob Walder: "Re: IPS technology question."

    Relevant Pages

    • RE: IDS and SSL
      ... Nothing short of a big road-block could monitor encrypted traffic prior ... HIDS solutions can "hook" into the OS ... I have been a VERY big advocate of HIDS replacing NIDS for some time ... encryption mechanisms will ultimately replace ALL traffic on a ...
      (Vuln-Dev)
    • RE: using HIDS for change control
      ... If you just want to monitor changes, ... If you want active detection and file change detection, ... Does anyone on this list know of a sponsor that is using HIDS to monitor ... with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • Re: 10 Meter Radios ?
      ... The FCC does no monitoring. ... They don't monitor the ham bands unless an active investigation is ... Oh Shit, here we go again, grab the boots, it's getting deep.. ... Agents do not ride with deputies of any police entity number one, ...
      (rec.radio.cb)