What would be considered the biggest drawback of Host-based Intrusion Detection systems (HIDS)?
Click on the arrows to vote for the correct answer
A. B. C. D.A.
The biggest drawback of HIDS, and the reason many organizations resist its use, is that it can be very invasive to the host operating system.
HIDS must have the capability to monitor all processes and activities on the host system and this can sometimes interfere with normal system processing.
HIDS versus NIDS - A host-based IDS (HIDS) can be installed on individual workstations and/ or servers to watch for inappropriate or anomalous activity.
HIDSs are usually used to make sure users do not delete system files, reconfigure important settings, or put the system at risk in any other way.
So, whereas the NIDS understands and monitors the network traffic, a HIDSs universe is limited to the computer itself.
A HIDS does not understand or review network traffic, and a NIDS does not "look in" and monitor a system's activity.
Each has its own job and stays out of the other's way.
The ISC2 official study book defines an IDS as: An intrusion detection system (IDS) is a technology that alerts organizations to adverse or unwanted activity.
An IDS can be implemented as part of a network device, such as a router, switch, or firewall, or it can be a dedicated IDS device monitoring traffic as it traverses the network.
When used in this way, it is referred to as a network IDS, or NIDS.
IDS can also be used on individual host systems to monitor and report on file, disk, and process activity on that host.
When used in this way it is referred to as a host-based IDS, or HIDS.
An IDS is informative by nature and provides real-time information when suspicious activities are identified.
It is primarily a detective device and, acting in this traditional role, is not used to directly prevent the suspected attack.
What about IPS? In contrast, an intrusion prevention system (IPS), is a technology that monitors activity like an IDS but will automatically take proactive preventative action if it detects unacceptable activity.
An IPS permits a predetermined set of functions and actions to occur on a network or system; anything that is not permitted is considered unwanted activity and blocked.
IPS is engineered specifically to respond in real time to an event at the system or network layer.
By proactively enforcing policy, IPS can thwart not only attackers, but also authorized users attempting to perform an action that is not within policy.Fundamentally, IPS is considered an access control and policy enforcement technology, whereas IDS is considered network monitoring and audit technology.
The following answers were incorrect: All of the other answer were advantages and not drawback of using HIDS TIP FOR THE EXAM: Be familiar with the differences that exists between an HIDS, NIDS, and IPS.Know that IDS's are mostly detective but IPS are preventive.IPS's are considered an access control and policy enforcement technology, whereas IDS's are considered network monitoring and audit technology.
Reference(s) used for this question: Harris, Shon (2012-10-25)
CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 5817-5822)
McGraw-Hill.
Kindle Edition.
and Schneiter, Andrew (2013-04-15)
Official (ISC)2 Guide to the CISSP CBK, Third Edition : Access Control ((ISC)2 Press), Domain1, Page 180-188 or on the kindle version look for Kindle Locations 3199-3203
Auerbach Publications.
The correct answer to the question is A: "It can be very invasive to the host operating system."
Host-based Intrusion Detection Systems (HIDS) are software tools that monitor and analyze activity on individual hosts or endpoints, such as servers, workstations, or mobile devices. Unlike Network-based Intrusion Detection Systems (NIDS), which monitor network traffic and packets, HIDS focus on the behavior of applications, processes, and files running on a specific system.
While HIDS can provide a high level of detail and visibility into the activities occurring on a host system, they also have several drawbacks, with the most significant being their potential invasiveness to the host operating system. HIDS require installation and integration with the host operating system to function, which can introduce security vulnerabilities, compatibility issues, and performance overheads.
Additionally, HIDS may need to monitor system calls and kernel-level events, which requires elevated privileges and can lead to system instability or crashes. HIDS may also generate a large number of false positives or false negatives, leading to an overload of alerts or missed detections of actual threats.
In contrast, NIDS can provide a broader view of network traffic and can be more scalable and easier to manage than HIDS. However, they may be less effective at detecting threats that originate from inside the network perimeter, and they cannot detect threats that are not transmitted over the network.
Overall, organizations must weigh the benefits and drawbacks of both HIDS and NIDS to determine the best combination of intrusion detection methods for their specific needs and risk profile.