HP-UX Host Intrusion Detection System (HIDS) is an intrusion detection system that enhances local host-level security within a network. It automatically monitors each configured host system within the network for possible signs of unwanted and potentially damaging intrusions. If an intrusion is successful, it can lead to the loss of availability of key systems or compromise system integrity.
HP-UX HIDS continuously examines ongoing activity on a system, and it seeks out patterns that suggest security breaches or misuses. Security threats or breaches can include attempts to break into a system, subversive activities, or spreading a virus. Once you activate HP-UX HIDS for a given host system and it detects an intrusion attempt, the host sends an alert to the administrative interface where you can immediately investigate the situation, and when necessary, take action against the intrusion. In addition, you can set up customized local responses to alerts.
HP-UX HIDS can provide notification in the event of suspicious activity that can precede an attack. By contrast, other intrusion detection systems often allow a potential intruder considerable time to damage a system before being detected, because they rely on an operator-instigated analysis of system log files, typically performed at the end of the day.
HP-UX HIDS is useful for enterprise environments where centralized management tools control networks of heterogeneous systems. These environments can include web servers, transaction processors, application servers, and database systems.
HP-UX HIDS uses knowledge about how host systems, the network, or the entire enterprise can be exploited, and applies that expertise to the flow of system events. Many intrusions, while differing in their scenarios, reuse the same building blocks to exploit a wide variety of system vulnerabilities. HP-UX HIDS uses known building blocks to protect resources against existing attack scenarios and unknown scenarios.
HP-UX HIDS provides simplified administration through a secure graphical user interface (GUI), the HP-UX HIDS System Manager.
HP-UX HIDS provides customizable intrusion response capabilities. Hosts always send alerts to the administration interface. You can augment these notifications with automated host-based response programs that you can customize for the host that is being monitored. HP provides a customized program for OpenView Operations (OVO) integration; you can also create your own.
HP-UX HIDS Limitations |
 |
HP-UX HIDS cannot solve all security-related problems. Following are the limitations of HP-UX HIDS:
HP-UX HIDS is not a replacement for comprehensive security policies and procedures. You must define and implement security policies and procedures, and configure HP-UX HIDS to enforce them. A lack of comprehensive policies, procedures, and configuration can result in attacks going undetected. HP-UX HIDS can also report false alerts, while your system remains vulnerable.
HP-UX HIDS does not prevent the onset of attacks. If your system is vulnerable to attacks, those vulnerabilities remain even after HP-UX HIDS is installed.
HP-UX HIDS does not find static security flaws on a system, nor does it prevent the onset of attacks. It only reports the possibility of an attack or an intrusion. For example, if a password file contained an illegitimate account before HP-UX HIDS was installed, that illegitimate account remains vulnerable even after HP-UX HIDS is installed and operational. Furthermore, HP-UX HIDS cannot authenticate users of a valid account. For example, if users share passwords, HP-UX HIDS cannot ascertain the identity of the user gaining access to the system.
Printable version
