IDS: Re: HIDS/HIPS Selection Process

["Drew Simonis" <simonis () myself com>]

If I were going to deploy a host product as broadly as you have indicated, 
I would also look at things like ease of agent management, policy development
and deployment, integration with SIM products or integration with my response
process.  I would also evaluate the security relevant application specifics,
such as the context the application runs in, can the user disable it, how 
does it handle crashes, etc.  From a performance aspect, I might want to know
the load the application puts on my systems, how chatty is it on the network 
and are the communications compressed and encrypted.

I'd also test local attacks and see how the system responds to them.  

-Drew


----- Original Message -----
From: astalavista.box.sk () gmail com
To: focus-ids () securityfocus com
Subject: HIDS/HIPS Selection Process
Date: 9 Jan 2006 17:58:57 -0000

> Our company is about to embark on a search for a HIDS/HIPS solution.
> We would like something that can be deployed to servers but our 
> primary interest is being able to roll it out to all user laptops 
> and possibly even all desktops as well.
>
> I am most aware of (I wouldnt say I am familiar with them) Cisco's 
> CSA and Eeye's Blink offering and am trying to build some sort of 
> methodology for testing various HIDS/HIPS options and comparing 
> them against one another.
> My initial thought is to have a number of workstations, each 
> installed with its own HIDS but an identical image other than that. 
>   I will use our standard desktop image which is missing a couple 
> MS Patches and anticipate testing the results across all the 
> workstations of working metasploit against known vulnerabilities 
> and maybe installing a worm onto a separate machine in this 
> isolated environment to see how each deals with it.  Probably also 
> subject each host to a nessus or retina scan to see not only what 
> it reveals but also how it handles a scan.
>
> Does anyone know if such a document/framework/plan exists (like in 
> the SANS reading room or somewhere)?
> Do you have any suggestions as to what I should include in my 
> process?  I have a basic idea as outlined above which I will begin 
> to refine but the more input you can offer me as to what specific 
> measurable constructs I should apply in each facet of testing would 
> be appreciated.
> Any other products that you would reccomend we include in the product survey?
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------

-- 
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------