HP's Host Intrusion Detection System (HIDS) alerts you about hackers who have reached the HP-UX 11i operating environment and are about to do harm in the places most critical to your computing environment... the operating system and applications.
Host intrusion detection is being deployed as part of a security solution to satisfy regulatory compliance requirements e.g. SOX, HIPPA, and CISP. For example, Campana has deployed HIDS to help comply with PCI standards.
reports that insider attacks are about as common as outsider attacks, supporting the claim that HIDS is absolutely necessary to fully protect mission-critical servers.
The HP-UX 11i builders are the best at detection: HP is in the best position to know the possible intrusion routes and take action upon the high-quality kernel audit data of the operating system. Third-party vendors are unable to integrate detection in the kernel the way HP does to offer the most complete analysis and detection.
HP detection template: HP detection templates guard and focus on areas vulnerable to attack. These are the areas in HP-UX 11i (as in any operating system) that intruders probe and try to exploit. When a profiled event is detected, it is passed to a correlation engine that determines whether vulnerability is being exploited. This unique and sophisticated approach to intrusion detection recognises most current attack scenarios and some future attacks yet to be invented.
| Vulnerability | What HIDS monitors |
|---|---|
| Poorly written privileged programs | Poorly written privileged programs |
| Unauthorised File Modification | Critical system and application programs and Configuration files System and application log files File additions and deletion Critical files made world writable Privileged 'setuid' programs created Files modified by non-owners |
| Weak password or unauthorised access | Logins/Logouts |
| Password guessing | Failed logins and failed switch-user attempts |
An alert triggered by a successful login contains the name and IP address of the remote host from which the login was made, as well as the pseudo device associated with the login session. This is helpful in identifying attackers for action based on security policy.
Alerts are also written to a local log file for archiving and to allow the Administrative GUI to retrieve missed alerts that were generated when it was either not running or could not connect to HIDS sensors on the monitored host(s).
In addition to sending user notifications, response scripts can be used to carry out other tasks automatically such as restoring defaced web pages from a reliable source (e.g., read only media).
The System Management GUI identifies what surveillance schedules are running on each host system. Combining one or more detection templates creates a surveillance group. Surveillance groups can form strategic protection for appropriate hosts such as application servers.
Surveillance groups or patterns that are mapped to schedule times create surveillance schedules.
Surveillance schedules
Surveillance schedules can be tailored based on the applications and activity on the host. For example, HIDS on a host, running a database application can be configured to run a surveillance schedule to generate high severity alerts for all logins except those by the database administrator. Surveillance schedules might be created for backup operations, test operations, and maintenance and established for tagged surveillance groups of servers.
Provides for role-based monitoring and administration based on user profiles.
Communication between the Administrative GUI and the HIDS sensors on the monitored hosts is secured, both for integrity and privacy, using the Secure Socket Layer (SSL) protocol.
Certificate management is self-contained and does not require a pre-existing public key infrastructure (PKI). Manpages are included with the product bits; a User's Guide and Release Notes are available from the Instant Information CD and also HP’s documents site.
