RE: using HIDS for change control

["Evans, Arian" <Arian.Evans () fishnetsecurity com>]

Angel,

I used to use the Pentasafe "HIDS" for this but the
Windows agents flat-out didn't work. NetIQ has I believe
scrapped these agents and I don't know if they employ
the same monitoring in the current line.

Bindview had similar potential capabilities three years
ago but I don't believe they had prebuilt "rules". This
was similar to HP Openview ManageX agents. I haven't played
with this for a few years so a lot may have changed.

The answer bears strongly on your definition of "HIDS".
On Windows you could use NetIQ's GPO/LPO monitor and
if you configure f/s auditing properly on NTFS, monitor
this though event-log parsers, or local agents (see above),
or 'HIPS' like CSA.

I know people using Tripwire and one gov that uses Entercept
for "change control".

So the answer is yes.

It's really all in the definition of what "change control"
and "change management" consist of I believe, though.

'Change Management' has to be up there in the top 10 with
'anomaly detection', 'behavioral analysis' and 'Application
Security' for most equivocal terms used in infosec.

Arian 

> -----Original Message-----
> From: Rivera,Angel L. [mailto:ARIVERA () mitre org] 
> Sent: Wednesday, August 24, 2005 5:10 PM
> To: focus-ids () lists securityfocus com
> Subject: RE: using HIDS for change control
>
> Does anyone on this list know of a sponsor that is using HIDS 
> to monitor
> changes to a system's (Unix & Windows) configuration?
>  
> The goal is to build a server according to specs (this would include
> hardening of the OS + agency specific security settings) then 
> use a HIDS
> to detect and alert on any changes.
>  
> Theoretically speaking, I know this can be done, but is anyone doing
> this?
>
> --------------------------------------------------------------
> ----------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------
> ----------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------