Re: NIDS and HIDS

On Thu, 02 Dec 2004 10:03:49 +1300, Jason Haar <jason.haar@trimble.co.nz> wrote:
 
> Slightly OT - but are the days of filesystem monitoring over? I mean,
> systems must move towards automated updates (e.g. Windows Update, YUM) -
> which means that "the system" can and will change OS files at will. A
> filesystem integrity checking solution will go off nearly daily in such
> an environment.

The day I let production servers automatically update will be the day
they pry my sandles off my cold, dead feet. :)

But seriously, I don't think so. Whenever we do an update, it's done
in a lab test environment first. In addition to the regular tests (ie
- does this patch break our applications?), they also do a comparison
with tripwire. That way, we have a list of files that are going to
change when the patch is applied. Part of Patch Management's job
include updating the HIDS, installing the patch, then approving the
changed files.

Automatic updating is nice (when it works), but will I trade host
integrity checking for it? Not a chance.
-- 
Matthew 'Shandower' Romanek
IDS Analyst

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------