Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a traditional NIPS or HIPS?

  • Hi guys, I wanted to check with you specifically for the Symantec HIPS module, if this could help monitor and log any alerts and what sort of Network intrusion or events should the IPS policy have enabled to address security controls – tulasi Jun 5 '15 at 7:15

No, you cannot interchangeably deploy HI?S versus NI?S. They attack different subsets of the same problem.

Most simply N* is limited to network inputs, whereas H* has access to a far richer set of inputs (files! processes! network listeners!) to be judgmental about (and has less network visibility, so usually doesn't have the rich network parsing and signature set that a N* does).

See also Can Snort be configured as HIDS?.

That said, if your concern is satisfying an auditor or security requirements that say HIDS/NIDS, then either will do - such requirements are often written solely with the goal of making sure you're taking extra steps to secure yourself, not with the goal of dictating one technology or another.

| improve this answer | |

Host intrusion detection is cooperative enforcement. Network intrusion detection will catch uncooperative hosts (ie: Linux machines that aren't installing your stuff), though highly uncooperative hosts will encrypt their traffic as well.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.