Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-782 | GEN006480 | SV-37746r2_rule | ECID-1 | Medium |
Description |
---|
Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion detection tool can provide methods to immediately lock out detected intrusion attempts. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 5 Security Technical Implementation Guide | 2014-01-09 |
Check Text ( C-36942r2_chk ) |
---|
Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. The preferred intrusion detection system is McAfee HBSS available through Cybercom. If another host-based intrusion detection application, such as SELinux, is used on the system, this is not a finding. Procedure: Examine the system to see if the Host Intrusion Prevention System (HIPS) is installed #rpm -qa | grep MFEhiplsm If the MFEhiplsm package is installed, HBSS is being used on the system. If another host-based intrusion detection system is loaded on the system # find / -name Where Determine if the application is active on the system. Procedure: # ps -ef | grep If no host-based intrusion detection system is installed on the system, this is a finding. |
Fix Text (F-32207r1_fix) |
---|
Install a host-based intrusion detection tool. |