Angel,
I used to use the Pentasafe "HIDS" for this but the
Windows agents flat-out didn't work. NetIQ has I believe
scrapped these agents and I don't know if they employ
the same monitoring in the current line.
Bindview had similar potential capabilities three years
ago but I don't believe they had prebuilt "rules". This
was similar to HP Openview ManageX agents. I haven't played
with this for a few years so a lot may have changed.
The answer bears strongly on your definition of "HIDS".
On Windows you could use NetIQ's GPO/LPO monitor and
if you configure f/s auditing properly on NTFS, monitor
this though event-log parsers, or local agents (see above),
or 'HIPS' like CSA.
I know people using Tripwire and one gov that uses Entercept
for "change control".
So the answer is yes.
It's really all in the definition of what "change control"
and "change management" consist of I believe, though.
'Change Management' has to be up there in the top 10 with
'anomaly detection', 'behavioral analysis' and 'Application
Security' for most equivocal terms used in infosec.
Arian
-----Original Message-----
From: Rivera,Angel L. [mailto:ARIVERA@mitre.org]
Sent: Wednesday, August 24, 2005 5:10 PM
To: focus-ids@lists.securityfocus.com
Subject: RE: using HIDS for change control
Does anyone on this list know of a sponsor that is using HIDS
to monitor
changes to a system's (Unix & Windows) configuration?
The goal is to build a server according to specs (this would include
hardening of the OS + agency specific security settings) then
use a HIDS
to detect and alert on any changes.
Theoretically speaking, I know this can be done, but is anyone doing
this?
--------------------------------------------------------------
----------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------
----------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
