2

I'm a little bit confused about what a host-based intrusion prevention system is. In order to better understand this concept, I'd like to introduce you a case.

Let's say someone designed the following software:

  • The software must be installed on a host.
  • The software is designed to protect a single host.
  • The software checks network packets sent to the host against a set of signatures.

Could this software be called a host-based intrusion prevention system?
If not can you tell me why?

1

The software must be installed on a host.

Yes, you need to install it :)

The software is designed to protect a single host.

Yes, by definition, HIDS focuses on a single host/endpoint.

The software checks network packets sent to the host against a set of signatures.

I prefer to quote you this directly from an official and reliable source in this field:

HIDS work primarily by monitory system logs and behavior and can be signature based (include rule sets that enforce tailored security policies) or behavioral based. Most organizations use both types of IDSs. They use HIDSs to secure critical host systems and NIDSs to secure their network(s).

Regarding the description you gave, the answer is definitely Yes.

4
  • Thank you for you answer. The fact that this piece of software lacks of some of the features we usually find in HIDSs like log monitoring or file monitoring doesn't discard it as an HIDS, right? – Othman Aug 16 '15 at 10:54
  • @Othman Your software does need to fulfill all the tasks to be qualified as an HIDS: the simple fact your software focuses already on one single task to protect your host is enough to qualify it as an HIDS – user45139 Aug 16 '15 at 10:56
  • @begueraj Did you mean "Does not need to fulfill ..."? – Othman Aug 16 '15 at 11:00
  • Yes does not need ... it is just a typo, sorry @Othman – user45139 Aug 16 '15 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.