Angel, I used to use the Pentasafe "HIDS" for this but the Windows agents flat-out didn't work. NetIQ has I believe scrapped these agents and I don't know if they employ the same monitoring in the current line.
Bindview had similar potential capabilities three years ago but I don't believe they had prebuilt "rules". This was similar to HP Openview ManageX agents. I haven't played with this for a few years so a lot may have changed. The answer bears strongly on your definition of "HIDS". On Windows you could use NetIQ's GPO/LPO monitor and if you configure f/s auditing properly on NTFS, monitor this though event-log parsers, or local agents (see above), or 'HIPS' like CSA. I know people using Tripwire and one gov that uses Entercept for "change control". So the answer is yes. It's really all in the definition of what "change control" and "change management" consist of I believe, though. 'Change Management' has to be up there in the top 10 with 'anomaly detection', 'behavioral analysis' and 'Application Security' for most equivocal terms used in infosec. Arian > -----Original Message----- > From: Rivera,Angel L. [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 24, 2005 5:10 PM > To: [EMAIL PROTECTED] > Subject: RE: using HIDS for change control > > Does anyone on this list know of a sponsor that is using HIDS > to monitor > changes to a system's (Unix & Windows) configuration? > > The goal is to build a server according to specs (this would include > hardening of the OS + agency specific security settings) then > use a HIDS > to detect and alert on any changes. > > Theoretically speaking, I know this can be done, but is anyone doing > this? > > -------------------------------------------------------------- > ---------- > Test Your IDS > > Is your IDS deployed correctly? > Find out quickly and easily by testing it > with real-world attacks from CORE IMPACT. > Go to > http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 > to learn more. > -------------------------------------------------------------- > ---------- > > ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
