HP-UX Host Intrusion Detection System Version 4.3 administrator guide

HP-UX HIDS Functionality
HP-UX Host Intrusion Detection System (HIDS) is an intrusion detection system that enhances
local host-level security within a network. It automatically monitors each configured host system
within the network for possible signs of unwanted and potentially damaging intrusions. If an
intrusion is successful, it can lead to the loss of availability of key systems or compromise system
integrity.
HP-UX HIDS continuously examines ongoing activity on a system, and it seeks out patterns that
suggest security breaches or misuses. Security threats or breaches can include attempts to break
into a system, subversive activities, or spreading a virus. Once you activate HP-UX HIDS for a
given host system and it detects an intrusion attempt, the host sends an alert to the administrative
interface where you can immediately investigate the situation, and when necessary, take action
against the intrusion. In addition, you can set up customized local responses to alerts.
HP-UX HIDS can provide notification in the event of suspicious activity that can precede an
attack. By contrast, other intrusion detection systems often allow a potential intruder considerable
time to damage a system before being detected, because they rely on an operator-instigated
analysis of system log files, typically performed at the end of the day.
HP-UX HIDS is useful for enterprise environments where centralized management tools control
networks of heterogeneous systems. These environments can include web servers, transaction
processors, application servers, and database systems.
HP-UX HIDS uses knowledge about how host systems, the network, or the entire enterprise can
be exploited, and applies that expertise to the flow of system events. Many intrusions, while
differing in their scenarios, reuse the same building blocks to exploit a wide variety of system
vulnerabilities. HP-UX HIDS uses known building blocks to protect resources against existing
attack scenarios and unknown scenarios.
HP-UX HIDS provides simplified administration through a secure graphical user interface (GUI),
the HP-UX HIDS System Manager.
HP-UX HIDS provides customizable intrusion response capabilities. Hosts always send alerts
to the administration interface. You can augment these notifications with automated host-based
response programs that you can customize for the host that is being monitored. HP provides a
customized program for OpenView Operations (OVO) integration; you can also create your own.
HP-UX HIDS Limitations
HP-UX HIDS cannot solve all security-related problems. Following are the limitations of HP-UX
HIDS:
• HP-UX HIDS is not a replacement for comprehensive security policies and procedures. You
must define and implement security policies and procedures, and configure HP-UX HIDS
to enforce them. A lack of comprehensive policies, procedures, and configuration can result
in attacks going undetected. HP-UX HIDS can also report false alerts, while your system
remains vulnerable.
• HP-UX HIDS does not prevent the onset of attacks. If your system is vulnerable to attacks,
those vulnerabilities remain even after HP-UX HIDS is installed.
• HP-UX HIDS does not find static security flaws on a system, nor does it prevent the onset
of attacks. It only reports the possibility of an attack or an intrusion. For example, if a
password file contained an illegitimate account before HP-UX HIDS was installed, that
illegitimate account remains vulnerable even after HP-UX HIDS is installed and operational.
Furthermore, HP-UX HIDS cannot authenticate users of a valid account. For example, if
users share passwords, HP-UX HIDS cannot ascertain the identity of the user gaining access
to the system.
HP-UX HIDS Functionality 23