RE: HIDS/HIPS Selection Process

["Spyro Malaspinas" <spyro.malaspinas () gmail com>]

There is a good article which can be found in security focus in Nov 2005,
(http://informationsecurity.techtarget.com/magLogin/1,291245,sid42_gci113792
5,00.html) where they did a bake off of IPS solutions, though they are
network based, many of the same considerations are suggested.

Specifically you want to be wary of 

1. The ability of the HIPS/HIDS solution to work with the applications that
you have running on your network.  Many custom apps are written which do not
abide by RFC specifications and may make unusually system calls etc.  

2.  Next look to ensure that they support the variety of platforms that you
have in production, their obligation to support new OS (Solaris 10, Vista,
etc.).

3. Length of time it takes to tune policies, the management interface that
the solution provides. 

4. Its ability to tie into current SIMs if any are present.

5. Ability to push patches from management console instead of requiring an
administrator to go out and touch each installed agent.

6. Are the solutions anomaly based or signature based or both?

-Spyro Malaspinas


-----Original Message-----
From: Drew Simonis [mailto:simonis () myself com] 
Sent: Tuesday, January 17, 2006 8:46 AM
To: astalavista.box.sk () gmail com; focus-ids () securityfocus com
Subject: Re: HIDS/HIPS Selection Process

If I were going to deploy a host product as broadly as you have indicated, 
I would also look at things like ease of agent management, policy
development
and deployment, integration with SIM products or integration with my
response
process.  I would also evaluate the security relevant application specifics,
such as the context the application runs in, can the user disable it, how 
does it handle crashes, etc.  From a performance aspect, I might want to
know
the load the application puts on my systems, how chatty is it on the network

and are the communications compressed and encrypted.

I'd also test local attacks and see how the system responds to them.  

-Drew


----- Original Message -----
From: astalavista.box.sk () gmail com
To: focus-ids () securityfocus com
Subject: HIDS/HIPS Selection Process
Date: 9 Jan 2006 17:58:57 -0000

> Our company is about to embark on a search for a HIDS/HIPS solution.
> We would like something that can be deployed to servers but our 
> primary interest is being able to roll it out to all user laptops 
> and possibly even all desktops as well.
>
> I am most aware of (I wouldnt say I am familiar with them) Cisco's 
> CSA and Eeye's Blink offering and am trying to build some sort of 
> methodology for testing various HIDS/HIPS options and comparing 
> them against one another.
> My initial thought is to have a number of workstations, each 
> installed with its own HIDS but an identical image other than that. 
>   I will use our standard desktop image which is missing a couple 
> MS Patches and anticipate testing the results across all the 
> workstations of working metasploit against known vulnerabilities 
> and maybe installing a worm onto a separate machine in this 
> isolated environment to see how each deals with it.  Probably also 
> subject each host to a nessus or retina scan to see not only what 
> it reveals but also how it handles a scan.
>
> Does anyone know if such a document/framework/plan exists (like in 
> the SANS reading room or somewhere)?
> Do you have any suggestions as to what I should include in my 
> process?  I have a basic idea as outlined above which I will begin 
> to refine but the more input you can offer me as to what specific 
> measurable constructs I should apply in each facet of testing would 
> be appreciated.
> Any other products that you would reccomend we include in the product
survey?
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------


-- 
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------