IDS mailing list archives
Re: NIDS and HIDS
From: Matthew Romanek <shandower () gmail com>
Date: Fri, 3 Dec 2004 06:38:39 -0800
On Thu, 02 Dec 2004 10:03:49 +1300, Jason Haar <jason.haar () trimble co nz> wrote:
Slightly OT - but are the days of filesystem monitoring over? I mean, systems must move towards automated updates (e.g. Windows Update, YUM) - which means that "the system" can and will change OS files at will. A filesystem integrity checking solution will go off nearly daily in such an environment.
The day I let production servers automatically update will be the day they pry my sandles off my cold, dead feet. :) But seriously, I don't think so. Whenever we do an update, it's done in a lab test environment first. In addition to the regular tests (ie - does this patch break our applications?), they also do a comparison with tripwire. That way, we have a list of files that are going to change when the patch is applied. Part of Patch Management's job include updating the HIDS, installing the patch, then approving the changed files. Automatic updating is nice (when it works), but will I trade host integrity checking for it? Not a chance. -- Matthew 'Shandower' Romanek IDS Analyst -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Re: NIDS and HIDS Bastian Ballmann (Dec 01)
- <Possible follow-ups>
- Re: NIDS and HIDS Karel Chwistek (Dec 01)
- Re: NIDS and HIDS Jason Haar (Dec 02)
- Re: NIDS and HIDS Matthew Romanek (Dec 03)
- open source ids list for implementation gaurav_jindal (Dec 07)
- Re: NIDS and HIDS Jason Haar (Dec 02)
- Re: NIDS and HIDS Matthew Romanek (Dec 01)
- RE: NIDS and HIDS Timm, Kevin (Dec 02)
- RE: NIDS and HIDS Chris Petersen (Dec 02)
- Re: NIDS and HIDS KC (Dec 06)
- Re: NIDS and HIDS Martin Mkrtchian (Dec 08)
- RE: NIDS and HIDS Maynor, David (ISS Atlanta) (Dec 09)