IDS mailing list archives
RE: using HIDS for change control
From: "Andrew Plato" <andrew.plato () anitian com>
Date: Thu, 25 Aug 2005 21:43:24 -0700
If you just want to monitor changes, Tripwire does this. However, that is all it does. Its an "after the fact" intrusion detection. If you want active detection and file change detection, RealSecure Server Sensor does this. It can do in-line, real time IPS and monitor the file system for changes. And there is a version for both Windows and UNIX. DISCLAIMER: I sell these solutions. ___________________________________ Andrew Plato, CISSP President/Principal Consultant ANITIAN ENTERPRISE SECURITY 3800 SW Cedar Hills Blvd, Suite 280 Beaverton, OR 97005 503-644-5656 Office 503-214-8069 Fax 503-201-0821 Mobile www.anitian.com ___________________________________ GPG fingerprint: 16E6 C5B0 B6CB F287 776E E9A9 AF47 9914 3582 633D GPG public key available at: http://www.anitian.com/corp/keys.htm -----Original Message----- From: Rivera,Angel L. [mailto:ARIVERA () mitre org] Sent: Wednesday, August 24, 2005 3:10 PM To: focus-ids () lists securityfocus com Subject: RE: using HIDS for change control Does anyone on this list know of a sponsor that is using HIDS to monitor changes to a system's (Unix & Windows) configuration? The goal is to build a server according to specs (this would include hardening of the OS + agency specific security settings) then use a HIDS to detect and alert on any changes. Theoretically speaking, I know this can be done, but is anyone doing this? ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- RE: using HIDS for change control Rivera,Angel L. (Aug 24)
- RE: using HIDS for change control Daniel Cid (Aug 25)
- RE: using HIDS for change control Ron Gula (Aug 25)
- <Possible follow-ups>
- RE: using HIDS for change control Evans, Arian (Aug 25)
- RE: using HIDS for change control Andrew Plato (Aug 27)
- RE: using HIDS for change control Rivera,Angel L. (Aug 27)