CYB236 Chapter 8: Host-based Intrusion Detection Systems

Overview of Host-Based IDPS

• Shim serves to intercept and analyze data between the application layer and the operating system, enhancing security behavior.
• Host-based Intrusion Detection and Prevention Systems (IDPS) typically log events such as failed logins, unauthorized access attempts, and system file changes.

Capabilities and Limitations

• Host-based IDPSs can monitor user activity, detect policy violations, and assess the integrity of files.
• A limitation includes the inability to detect network-based attacks, as they focus on host rather than network level monitoring.

Detection and Prevention

• Host-based IDPSs can detect events like file manipulations, configuration changes, and unusual application behavior.
• Prevention capabilities include blocking unauthorized access attempts and terminating malicious processes.
• Security capabilities consist of ensuring compliance with security policies and monitoring for malware on the host.

Functionality and Components

• The primary function is to enhance security at the host level through continuous monitoring and real-time analysis.
• A typical component is the agent, which resides on the host and performs monitoring tasks.

Agent Roles and Deployment

• Agents monitor events and activities such as user access and application performance on servers.
• Specific application agents track activity solely related to designated services.
• Agents are generally deployed on individual hosts, such as servers and endpoint devices.

Agent Monitoring and Benefits

• Agents designed for user hosts monitor user actions, file access, and applications.
• The benefit of utilizing a host-based IDPS includes granular monitoring leading to detailed insights and responses to threats.

Specialized Monitoring Functions

• Network Traffic Filtering focuses on analyzing and blocking unauthorized or suspicious network connections.
• Filesystem Monitoring safeguards against unauthorized changes in files and directories.
• Removable Media Restriction prevents the unauthorized use of USB drives and external storage.
• Audiovisual Device Monitoring ensures that devices like webcams and microphones are not exploited for surveillance.
• Host Hardening aims to strengthen security configurations and reduce vulnerabilities on the host system.
• Process Status Monitoring keeps track of running processes to identify aberrant behavior or unauthorized execution.
• Network Traffic Sanitization cleanses network data streams to eliminate malicious content before entering the system.

Agent Updates and Management

• Updating agents in host-based IDPSs can be unique due to the coordination between systems, ensuring compatibility and functionality.
• Management is crucial for overseeing the deployment, configuration, and incident response efforts pertaining to the host-based IDPS.

This quiz covers the components and architecture of host-based intrusion detection systems, including their capabilities, taxonomy of anomaly detection, and management. It also explores the characteristics of a single host and events within that host for suspicious activity.