HP-UX Host Intrusion Detection System Version 4.4 Administrator Guide (5900-1634, April 2011)

HP-UX HIDS Functionality
HP-UX Host Intrusion Detection System (HIDS) is an intrusion detection system that enhances local
host-level security within a network. It automatically monitors each configured host system within
the network for possible signs of unwanted and potentially damaging intrusions. If an intrusion is
successful, it can lead to the loss of availability of key systems or compromise system integrity.
HP-UX HIDS continuously examines ongoing activity on a system, and it seeks out patterns that
suggest security breaches or misuses. Security threats or breaches can include attempts to break
into a system, subversive activities, or spreading a virus. Once you activate HP-UX HIDS for a given
host system and it detects an intrusion attempt, the host sends an alert to the administrative interface
where you can immediately investigate the situation, and when necessary, take action against the
intrusion. In addition, you can set up customized local responses to alerts.
HP-UX HIDS can provide notification in the event of suspicious activity that can precede an attack.
By contrast, other intrusion detection systems often allow a potential intruder considerable time to
damage a system before being detected, because they rely on an operator-instigated analysis of
system log files, typically performed at the end of the day.
HP-UX HIDS is useful for enterprise environments where centralized management tools control
networks of heterogeneous systems. These environments can include web servers, transaction
processors, application servers, and database systems.
HP-UX HIDS uses knowledge about how host systems, the network, or the entire enterprise can be
exploited, and applies that expertise to the flow of system events. Many intrusions, while differing
in their scenarios, reuse the same building blocks to exploit a wide variety of system vulnerabilities.
HP-UX HIDS uses known building blocks to protect resources against existing attack scenarios and
unknown scenarios.
HP-UX HIDS provides simplified administration through a secure graphical user interface (GUI),
the HP-UX HIDS System Manager.
HP-UX HIDS provides customizable intrusion response capabilities. Hosts always send alerts to the
administration interface. You can augment these notifications with automated host-based response
programs that you can customize for the host that is being monitored. HP provides a customized
program for OpenView Operations (OVO) integration; you can also create your own.
HP-UX HIDS Limitations
HP-UX HIDS cannot solve all security-related problems. Following are the limitations of HP-UX HIDS:
• HP-UX HIDS is not a replacement for comprehensive security policies and procedures. You
must define and implement security policies and procedures, and configure HP-UX HIDS to
enforce them. A lack of comprehensive policies, procedures, and configuration can result in
attacks going undetected. HP-UX HIDS can also report false alerts, while your system remains
vulnerable.
• HP-UX HIDS does not prevent the onset of attacks. If your system is vulnerable to attacks, those
vulnerabilities remain even after HP-UX HIDS is installed.
• HP-UX HIDS does not find static security flaws on a system, nor does it prevent the onset of
attacks. It only reports the possibility of an attack or an intrusion. For example, if a password
file contained an illegitimate account before HP-UX HIDS was installed, that illegitimate account
remains vulnerable even after HP-UX HIDS is installed and operational. Furthermore, HP-UX
HIDS cannot authenticate users of a valid account. For example, if users share passwords,
HP-UX HIDS cannot ascertain the identity of the user gaining access to the system.
HP-UX HIDS Functionality 17