OSSEC - a free Intrusion Detection System

Some perspective..

 (Q)What is Host-based intrusion detection system (HIDS)?

(A) A host-based intrusion detection system is an intrusion detection system that is capable of monitoring and analyzing the internals of a computing system as well as the network packets on its network interfaces.  
(Q) Why do we need HIDS and what are its uses?

(A) The agent, which is installed on our servers communicates constantly with the master installed on another server. Any break-in attempt or software installations are communicated to master and based on rules and alert levels defined, master sends our Email and SMS notifications to relevant teams. All of this in real time.
(Q) Looks pretty standard, what else can this do ?

 (A) Based on the installed product, HIDS also has feature of executing scripts on agents in case a server is unreachable because of break-in. Also this architecture supports multiple agents, giving the ability of aggregation and security event management (SIEM) for all of our servers. Compliance is another aspect where SIEM tools are now mandatory for many industries.
(Q) How does HIDS monitor our server? What goes behind the screen?

 (A) Firstly, HIDS takes care of monitoring system, security and access logs, thus tracking any anomaly. It also monitors few OS specific important files for alterations. It then also looks for new software installations and malicious software. 
Finally.. (Q) what is OSSEC ?

 (A) OSSEC is one such implementation of HIDS to monitors all aspects of server activity with file integrity monitoring, log monitoring, rootcheck, and process monitoring. It mixes together all the aspects of Detection, Log monitoring, and Security Incident Management (SIM)/Security Information and Event Management (SIEM) together in a simple & powerful solution.

 OSSEC is free, open source software with GNU GPL v2 licence, thus effectively guarantees end users the freedom to run, study, share and modify the software.

In the next blog I will discuss step by step process to include OSSES in your IT Architecture and use it. For more details on OSSEC please visit: https://www.ossec.net/

 #OSSEC #ComputerSecurity #realTimeThreatAnalysis

Comments

Post a Comment

Popular posts from this blog

Unregulated to Regulated, path ahead

We have large low income population with limited access to traditional banking facilities like deposits and loans. Which means saving their hard earned money and availability of quick credit are missing. These are the same people who get attracted to ponzi schemes for higher returns or get them self entangled in circle of debt. Multiple moneylender laws were enacted to deter such scams. However failure to replace the role of money lenders gave rise to scams such as the saradha scam. The latest law to ban Unregulated deposit schemes is another step to stop such scams from happening. With this latest law, hand loans and many other loans become illegal as they are not regulated unless it is between relatives. While we still debate about the law, let us discuss about the alternatives for such non regulated loans. Recently RBI has created a new entity called NBFC-P2P. These NBFC companies play the role of mediator in between lenders and borrowers to facilitate the process of lo...
Read more

Second Chance...

Yesterday I was watching some movie which was based on a novel, which describes about a boy, called as Boy A, who was released into society after serving in a prison for 12 yrs, for commiting a murder at an early stage of 10 yrs. No one ever knew what exactly happened, but the movie says that there was another boy who actually initiated and commited the murder and Boy A was witnessing the crime. The concept seems to be simple: Who decides if some one should get a second chance, especially in a case which involve's death. The end of the movie was predictable as it has to show some meaningfull end, the boy comits suicide as his identity is no more a secret and he could not take anymore of societiy's oppression. But in real life it not always sure we get a definite end, what do you think ?
Read more

Lappy..

Vaio is so delicate that I hate it so much some times that I cannot use it in my normal rough and tough style.. But the momemt I see some movie or hear some song from it, I become its fan..
Read more