The system must have a host-based intrusion detection tool installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-782	GEN006480	SV-41526r1_rule	ECID-1	Medium

Description
Without a host-based intrusion detection tool, there is no system-level defense when an intruder gains access to a system or network. Additionally, a host-based intrusion detection tool can provide methods to immediately lock out detected intrusion attempts.

STIG	Date
Solaris 9 SPARC Security Technical Implementation Guide	2012-05-25

Details

Check Text ( C-285r2_chk )
A few applications providing host-based network intrusion protection are: - Dragon Squire by Enterasys Networks, - ITA by Symantec, - Hostsentry by Psionic Software, - Logcheck by Psionic Software, - RealSecure agent by ISS, and - Swatch by Stanford University. Ask the SA or IAO if a host-based intrusion detection application is loaded on the system. Determine if the application is loaded on the system. Procedure: # find / -name -print Determine if the application is active on the system. Procedure: # ps -ef \| grep If no host-based intrusion detection system is installed on the system, this is a finding.

Check Text ( C-285r2_chk )

A few applications providing host-based network intrusion protection are:

- Dragon Squire by Enterasys Networks,
- ITA by Symantec,
- Hostsentry by Psionic Software,
- Logcheck by Psionic Software,
- RealSecure agent by ISS, and
- Swatch by Stanford University.

Ask the SA or IAO if a host-based intrusion detection application is loaded on the system.

Determine if the application is loaded on the system.

Procedure:
# find / -name -print

Determine if the application is active on the system.

Procedure:
# ps -ef | grep

If no host-based intrusion detection system is installed on the system, this is a finding.

Fix Text (F-936r3_fix)
Install a host-based intrusion detection tool.