Re: Deploying Host based IDS: is there any benefit ??

[Sanjay Rawat <sanjayr () intoto com>]

Hi Pete:
you can harden the OS, but it doesn't mean that your applications are also 
hardened. By hardening the OS, you can,to some extent, prevent or avoid 
intrusions that are aimed to exploit OS itself, but what about applications 
that are running on it?
Also, syslog etc logs the events. but mere logging in not detection. you 
must have something which understand what is an attack, so that it can 
detect that. that is why IDS/IPS are there. you can also observe a  shift 
in present firewalls (application level firewalls) to better understand the 
events. therefore an IDS is needed to automatically monitor your system and 
detect event that could compromise your security (or sense of security!!!!)


Sanjay Rawat
Senior Software Engineer
INTOTO Software (India) Private Limited
Uma Plaza, Above HSBC Bank, Nagarjuna Hills
PunjaGutta,Hyderabad 500082 | India
Office: + 91 40 23358927/28 Extn 423
Website : www.intoto.com
  Homepage: http://sanjay-rawat.tripod.com

At 01:58 PM 8/3/2005, Pete wrote:
> Dear Security professionals,
>
> I have been assigned to deply Hist IDS...
> But I am trying to assess the benefits of HIDS vs devleopment of OS
> standard = OS hardening (UNIX and Windows).
> Indeed, I think deploying HIDS costs more time and money than OS
> hardening and for what benefit since it is a reactive solution.
> The maintainance of such a tool is heavy for operational team:
> When OS or applications versions change the HIDS agent has to be
> reinstalled, and the impact on business applications has to be
> assessed again.
>
> Regarding the features, it seems that the detection job of a Host IDS
> product can be done by advanced logging features of the OSs (syslog..)
> then only centralization and aggregation tool could be helpful.
>
> Please feel free to share your point of view or experience.
>
> Best regards,
>
> Pete
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------







------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------