Re: Real world experience with HIDS

[Paul Schmehl <pauls () utdallas edu>]

The problem with your response is it makes assumptions about my 
infrastructure and my needs (which I won't reveal on this list.)  In the 
real world (at least mine), I don't get to make the decisions about "what's 
best" for someone else's equipment.  If they want HIDS, not HIPS, then 
that's what I'm going to research.

Active defense is nice, but when it gets in the way of operations, decision 
makers won't allow it, in some case, even if it's what we would recommend.

Sometimes, as security professionals, we have to skin cats with other 
things than the best knives.

--On February 3, 2006 12:51:37 AM +0000 FinAckSyn <finacksyn () yahoo co uk> 
wrote:

> Hi Paul,
>
> Don't take this the wrong way, but you're asking the
> wrong questions!  :)
>
> > 1) Ease of install - can it be done through GPO?
> > SMS?  Login scripts?
>
> Zero-day attack prevention is far more important than
> ease of use.  DON'T choose a
> well-orchestrated/marketed product if it doesn't give
> you the protection you need.
>
> > 2) Usefulness of the information generated - have
> > you detected any
> > exploits?  How were you notified?  Etc.,
>
> The whole point of HIDS/HIPS should be to give you a
> last line of defence, once attackers/hackers/worms
> have got through your perimeter security.  Screw
> detection at this point.  You need active protection.
>
> > 3) Centralized management - is there any?  If so,
> > how easy is it to use?
> > Configurable at the host level?  Or group of hosts
> > level?
>
> There aren't any commerical HIPS/HIDS products that
> don't give you this.
>
> > 4) Access to data - is it possible to restrict
> > access to the data so that
> > an administrator on the server would *not* be able
> > to see the output of the
> > HIDS?
>
> Setup separate 'security administrator' accounts, that
> separate day to day security event logging from day to
> day account administration.
>
> > 5) Interference with the server - does it consume
> > lots of memory or CPU?
>
> Only if they're badly written.
>
> > Is it proactive or passive?
>
> Ignore any passive products.  If an attacker has got
> through all your other protection (firewall, AV, IPS,
> IDS) then a passive product is not going to help you.
>
> > 6) Would you purchase again, if you had the option?
> >
> > PLEASE NOTE:  Any vendor on this list who emails me
> > suggesting their
> > product will be automatically dropped from
> > consideration, so be forewarned.
> > You're welcome to respond on the list, if you like,
> > but don't email me or you'll be eliminated from
> > consideration.
>
> I work for Cisco, Juniper, ISS, McAfee, Symantec,
> Trend and Check Point, and recommend them all
> throroughly.  Does this mean you'll drop the whole
> marketplace from consideration now ? :)
>
>
> --- Paul Schmehl <pauls () utdallas edu> wrote:
>
> > I have some questions for real world users (not
> > vendors) of HIDS products.
> > If you are using HIDS products *and* you're happy
> > with the results, please
> > respond to the following quesitons.
> >
> > 1) Ease of install - can it be done through GPO?
> > SMS?  Login scripts?
> >
> > 2) Usefulness of the information generated - have
> > you detected any
> > exploits?  How were you notified?  Etc.,
> >
> > 3) Centralized management - is there any?  If so,
> > how easy is it to use?
> > Configurable at the host level?  Or group of hosts
> > level?
> >
> > 4) Access to data - is it possible to restrict
> > access to the data so that
> > an administrator on the server would *not* be able
> > to see the output of the
> > HIDS?
> >
> > 5) Interference with the server - does it consume
> > lots of memory or CPU?
> > Is it proactive or passive?
> >
> > 6) Would you purchase again, if you had the option?
> >
> > PLEASE NOTE:  Any vendor on this list who emails me
> > suggesting their
> > product will be automatically dropped from
> > consideration, so be forewarned.
> > You're welcome to respond on the list, if you like,
> > but don't email me or
> > you'll be eliminated from consideration.
> >
> > Paul Schmehl (pauls () utdallas edu)
> > Adjunct Information Security Officer
> > University of Texas at Dallas
> > AVIEN Founding Member
> > http://www.utdallas.edu/ir/security/
> ------------------------------------------------------------------------
> > Test Your IDS
> >
> > Is your IDS deployed correctly?
> > Find out quickly and easily by testing it
> > with real-world attacks from CORE IMPACT.
> > Go to
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> > to learn more.
> ------------------------------------------------------------------------
> >
>
>
>
>
> ___________________________________________________________
> Yahoo! Photos – NEW, now offering a quality print service from just 8p
> a photo http://uk.photos.yahoo.com



Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------