This article explains very briefly that it is a "Host Intrusion Prevention System" vital element in the security model in layers (or depth). Motivation
If an attack gets through network-based defenses (firewalls, IPS, IDS, NAC, DDoS Defenses, etc.), The latest battleground is the operating system of the target PC or Server the attack so those be prepared. Another important element that makes the HIPS, is the fact that encrypted traffic can not be measured by network-based protections. Host-based defenses are more advanced "Host Intrusion Prevention System" and are the last barrier between the attacker and the goal.
What is and what a Host-IPS?
The anomalies are looking HIPS (Or bizarre behavior) at the operating system, check the modules loaded by the kernel, monitor the activity of filesystems, the system scans for rootkits, etc..
A successful intrusion is usually accompanied by a set of activities that attempt to discover HIPS. Usually the intruders looking to take over or use a system so they attacked, for it often install software that will allow future access to delete their tracks, keyloggers, spam software, botnet-type virus, spyware, etc. Today
the HIPS include features such as Firewall and Anti-maleware (anti-virus, anti-spyware, etc..). The Host IPS
are implemented agents installed directly on the system they protect. They closely monitor the kernel and services, including intercepting system calls or APIs. Considerations
HIPS Not all are equal and because they work at a very low level (by intercepting system calls and APIs) must take some precautions now to choose from:
As with the NIPS or NIDS, it is very important to have a good engine to detect anomalies. If only based on signatures "signatures" will never detect "zero-days exploits (exploits very recent for which the seller has not yet produced patches and signatures have not detected it.)
Before making a widespread implementation is important to check that the product chosen is compatible with all applications that are used in systems that are installed. It should focus on custom applications or order (home-grow, custom, etc.)..
is important that you can create your own rules and that they are simple to build. This is important because the seller creates a generic rules and may not take into account problems of our environment.
If there are many host environment (Desktop or Server) is important to provide mechanisms for centralized management and reporting. Some are manageable and even via LDAP is integrated with security management systems. It is important to be able to install the custom rules in all systems from a centralized location, as is recommended for reporting. While
HIPS are the best security tools are not foolproof, so do not replace the NIPS, Firewalls, VPNs, etc. And above all, have installed HIPS systems does not mean that it remains important to maintain current systems, apply all security patches and make periodic vulnerability scanning.
Finally, some commercial products:
References:
If an attack gets through network-based defenses (firewalls, IPS, IDS, NAC, DDoS Defenses, etc.), The latest battleground is the operating system of the target PC or Server the attack so those be prepared. Another important element that makes the HIPS, is the fact that encrypted traffic can not be measured by network-based protections. Host-based defenses are more advanced "Host Intrusion Prevention System" and are the last barrier between the attacker and the goal.
What is and what a Host-IPS?
The anomalies are looking HIPS (Or bizarre behavior) at the operating system, check the modules loaded by the kernel, monitor the activity of filesystems, the system scans for rootkits, etc..
A successful intrusion is usually accompanied by a set of activities that attempt to discover HIPS. Usually the intruders looking to take over or use a system so they attacked, for it often install software that will allow future access to delete their tracks, keyloggers, spam software, botnet-type virus, spyware, etc. Today
the HIPS include features such as Firewall and Anti-maleware (anti-virus, anti-spyware, etc..). The Host IPS
are implemented agents installed directly on the system they protect. They closely monitor the kernel and services, including intercepting system calls or APIs. Considerations
HIPS Not all are equal and because they work at a very low level (by intercepting system calls and APIs) must take some precautions now to choose from:
- must be stable (reliable) but the applications may not run correctly.
- should not negatively impact system performance.
- or activities should not block legitimate traffic (no "false positives").
As with the NIPS or NIDS, it is very important to have a good engine to detect anomalies. If only based on signatures "signatures" will never detect "zero-days exploits (exploits very recent for which the seller has not yet produced patches and signatures have not detected it.)
Before making a widespread implementation is important to check that the product chosen is compatible with all applications that are used in systems that are installed. It should focus on custom applications or order (home-grow, custom, etc.)..
is important that you can create your own rules and that they are simple to build. This is important because the seller creates a generic rules and may not take into account problems of our environment.
If there are many host environment (Desktop or Server) is important to provide mechanisms for centralized management and reporting. Some are manageable and even via LDAP is integrated with security management systems. It is important to be able to install the custom rules in all systems from a centralized location, as is recommended for reporting. While
HIPS are the best security tools are not foolproof, so do not replace the NIPS, Firewalls, VPNs, etc. And above all, have installed HIPS systems does not mean that it remains important to maintain current systems, apply all security patches and make periodic vulnerability scanning.
Finally, some commercial products:
- McAfee Host IPS Cisco Security Agent
- ISS - Proventia Desktop and
- Server Symantec Critical System Protection
References:
- http://www.nss.co.uk/WhitePapers/intrusion_prevention_systems.htm
- http://www.sans.org/whatworks/wall.php?id=2
- http://netsecurity.about.com/cs/firewallbooks/a/aa050804.htm
0 comments:
Post a Comment