HP-UX Host Intrusion Detection System Version 4.1 Administrator's Guide

1 Introduction
This chapter introduces the HP-UX Host Intrusion Detection System (HP-UX HIDS)
software, an HP-UX product that enhances the local host-level security within your
network.
This chapter addresses the following topics:
• “Importance of Intrusion Detection” (page 21)
• “HP-UX HIDS Functionality” (page 26)
• “HP-UX HIDS Limitations” (page 27)
• “HP-UX HIDS Components” (page 27)
• “Glossary of HP-UX HIDS Terms” (page 30)
Importance of Intrusion Detection
Some threats faced by almost all businesses today are the following:
• Loss of financial assets
Financial institutions are vulnerable even to trusted employees. With the advent
of Internet technology, several financial institutions transfer millions of dollars
over computer networks. In addition to easy access, this technology has made the
whole financial industry vulnerable to attacks.
• Loss of intellectual property
Intellectual property refers to unique knowledge or ideas about technology a
company owns. Intellectual property can be the design of a new engine, the code
to a new software product, or even the customer contact list. Intellectual property
must be handled with utmost care. Companies around the world face this challenge
everyday.
• Loss of computing resources
Information is of no use if it cannot be acted upon, and not having the computing
resources available to process information renders it useless. Any company that
offers its customers an online service is acutely aware of the potential losses that
can result from even a minute of downtime. This is especially true in the case of
web services. Lack of availability of critical computing resources because of
malicious actions is a serious threat faced by any company doing business on the
Internet today. Loss of business (measured in dollars) can be significant. Harder
to quantify, but more damaging in the long term, is the loss of consumer confidence
in a business that suffers an online attack. Another example of a loss of a critical
computing resource is a corporate email system crash. When the outage is caused
intentionally by an attacker who is continually disrupting business, the financial
Importance of Intrusion Detection 21