The system must have a host-based intrusion detection tool installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-782	GEN006480	SV-37746r1_rule	ECID-1	Medium

Description
Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion detection tool can provide methods to immediately lock out detected intrusion attempts.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2012-05-25

Details

Check Text ( C-36942r1_chk )
Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. The preferred intrusion detection system is McAfee HBSS available through Cybercom. Procedure: Examine the system to see if the Host Intrusion Prevention System (HIPS) is installed #rpm -qa \| grep MFEhiplsm If the MFEhiplsm package is installed, HBSS is being used on the system. If another host-based intrusion detection system is loaded on the system # find / -name Where is the name of the primary application daemon to determine if the application is loaded on the system. Determine if the application is active on the system. Procedure: # ps -ef \| grep If no host-based intrusion detection system is installed on the system, this is a finding.

Check Text ( C-36942r1_chk )

Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. The preferred intrusion detection system is McAfee HBSS available through Cybercom.

Procedure:
Examine the system to see if the Host Intrusion Prevention System (HIPS) is installed

#rpm -qa | grep MFEhiplsm

If the MFEhiplsm package is installed, HBSS is being used on the system.

If another host-based intrusion detection system is loaded on the system

# find / -name

Where is the name of the primary application daemon to determine if the application is loaded on the system.

Determine if the application is active on the system.

Procedure:
# ps -ef | grep

If no host-based intrusion detection system is installed on the system, this is a finding.

Fix Text (F-32207r1_fix)
Install a host-based intrusion detection tool.