RE: using HIDS for change control

["Andrew Plato" <andrew.plato () anitian com>]

If you just want to monitor changes, Tripwire does this. However, that
is all it does. Its an "after the fact" intrusion detection. 

If you want active detection and file change detection, RealSecure
Server Sensor does this. It can do in-line, real time IPS and monitor
the file system for changes. And there is a version for both Windows and
UNIX. 

DISCLAIMER: I sell these solutions.

___________________________________
Andrew Plato, CISSP
President/Principal Consultant
ANITIAN  ENTERPRISE  SECURITY

3800 SW Cedar Hills Blvd, Suite 280
Beaverton, OR 97005
503-644-5656 Office
503-214-8069 Fax
503-201-0821 Mobile
www.anitian.com
___________________________________

GPG fingerprint: 16E6 C5B0 B6CB F287 776E E9A9 AF47 9914 3582 633D
GPG public key available at: http://www.anitian.com/corp/keys.htm 
 
 

-----Original Message-----
From: Rivera,Angel L. [mailto:ARIVERA () mitre org] 
Sent: Wednesday, August 24, 2005 3:10 PM
To: focus-ids () lists securityfocus com
Subject: RE: using HIDS for change control

Does anyone on this list know of a sponsor that is using HIDS to monitor
changes to a system's (Unix & Windows) configuration?
 
The goal is to build a server according to specs (this would include
hardening of the OS + agency specific security settings) then use a HIDS
to detect and alert on any changes.
 
Theoretically speaking, I know this can be done, but is anyone doing
this?

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------