There should be some form of host intrusion detection and prevention functionality applied to endpoint devices.
Control Type: Technical
Control Function: Detective/Preventive
Description: Previous documentation discussed Network Intrusion Detection & Prevention Systems, which monitor network flows and alert on or forcibly stop malicious traffic entering a network. A Host Intrusion Detection/Prevention System (HIDS/HIPS) follows the same concept, only applied to individual endpoints instead of whole networks. These differ from host firewalls, which is software that enforces access rules and blocks unauthorized connections from penetrating the endpoint. HIDS/HIPS assist this functionality by detecting and stopping malicious access if it does manage to penetrate the endpoint.
Endpoint components that HIDS/HIPS monitors include:
- System logs (Windows Event Viewer, Linux /var/log)
- Processes
- Registry modifications
- System calls
- DLL files
- Privilege escalations
HIDS/HIPS functionality is often baked into larger Endpoint Detection & Response or SIEM systems. For example, Wazuh SIEM’s host agent provides the intrusion detection and prevention capabilities natively instead of relying on a third-party software relaying them. EDR platforms take the functionality of HIDS/HIPS and combine them with features such as response runbooks, proactive threat hunting, and compliance enforcement.
If an organization does not have a full stack EDR/SIEM setup, individual HIDS/HIPS systems can be purchased and used to provide the functionality individually. Options include the open-source OSSEC, as well as proprietary Symantec HIPS and McAfee Host IPS.