Re: Real world experience with HIDS

[Daniel Cid <danielcid () yahoo com br>]

Hi Paul,

I'm not an HIDS vendor, but I do develop the OSSEC
HIDS 
(an open source HIDS). I'm also a real user of HIDS :)


1- OSSEC HIDS only works with Unix system (linux,
solaris, *bsd, etc). The installation is pretty simple
(just a ./install.sh will do everything). You can
probably automate to install via scripts (no official
way to do that). Next release is going to have Windows
support.

2- I have detected real issues with it. It does log
analysis, integrity checking and rootkit detection. I
have detected brute forces on SSH being successful
(bad password), detected rootkits on the boxes, etc.

3- It does support centralized management. You install
agents on every system and they will report to the
analysis server. The analysis server will do
correlation, reporting, alerting, etc...
The centralized management is easy to install too..

4- The project currently does not have an UI.

5- Not much memory usage. It analyses on real time and
can execute active responses on the boxes (lock an
user account, block in the firewall or hosts.deny,
etc).

6- Well, it's free :)

Thanks,

Daniel Cid
--- Paul Schmehl <pauls () utdallas edu> escreveu:

> I have some questions for real world users (not
> vendors) of HIDS products. 
> If you are using HIDS products *and* you're happy
> with the results, please 
> respond to the following quesitons.
>
> 1) Ease of install - can it be done through GPO? 
> SMS?  Login scripts?
>
> 2) Usefulness of the information generated - have
> you detected any 
> exploits?  How were you notified?  Etc.,
>
> 3) Centralized management - is there any?  If so,
> how easy is it to use? 
> Configurable at the host level?  Or group of hosts
> level?
>
> 4) Access to data - is it possible to restrict
> access to the data so that 
> an administrator on the server would *not* be able
> to see the output of the 
> HIDS?
>
> 5) Interference with the server - does it consume
> lots of memory or CPU? 
> Is it proactive or passive?
>
> 6) Would you purchase again, if you had the option?
>
> PLEASE NOTE:  Any vendor on this list who emails me
> suggesting their 
> product will be automatically dropped from
> consideration, so be forewarned. 
> You're welcome to respond on the list, if you like,
> but don't email me or 
> you'll be eliminated from consideration.
>
> Paul Schmehl (pauls () utdallas edu)
> Adjunct Information Security Officer
> University of Texas at Dallas
> AVIEN Founding Member
> http://www.utdallas.edu/ir/security/
------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
------------------------------------------------------------------------
>



                
_______________________________________________________
Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora!
http://br.acesso.yahoo.com

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------