Definition

A HIDS is a type of cybersecurity solution that monitors IT systems for signs
of suspicious activity to detect unusual behaviours or patters associated
with either human users or applications that could be a sign of a security
breach or attempted attack.

They are so-named because they operate on individual host systems. In
context, a host could be a server, PC, or any other type of device that
produces logs, metrics and other data that can be monitored for security
purposes.

NIDS vs. HIDS

Network Intrusion Detection Systems (NIDS) monitor suspicious activity from
perspective of network. They use data sources like network switch logs,
analyse it, and look for suspicious activity.

HIDS can also monitor network activity, but it is in POV of individual host,
not through centralised equipment like switches. For HIDS, network data is
one of many sources for security analysis purposes.

How it Works?

1. Data Collection - HIDS constantly gather information from hosts (servers, computers, etc.). This includes security logs (like login attempts), application logs, system logs, and network traffic flows.
2. Analysis - Collected data is scrutinized for any suspicious patterns or activity that deviates from the normal baseline.
3. Potential Attacks - A HIDS might flag things like a sudden surge in requests from unknown sources (possible brute-force attack) or an application probing for vulnerabilities.
4. Response - Security teams use this information to block malicious activity or investigate further.
5. Contextual Intelligence - The most effective HIDS solutions correlate data from multiple sources. So, network traffic anomalies can be cross-referenced with application event logs, providing insights into whether an attack is underway or whether the software has already been compromised.

Types

1. Agent-based - Uses software agents installed on each host to collect information from host. This is "heavier" as running agents on hosts increase resource utilisation.
2. Agentless - Information from host is collected by streaming data over network (or some similar process). This is more complex to implement, and accesses fewer data. This consumes less resource.

Components

1. Data collectors - HIDS employs sensors to collect data from host.
2. Data storage - Data is aggregated and stored in central location. Retained as long as necessary to analyse, or archived for later use.
3. Analytics engine - Process and evaluate data. Purpose is to look for patterns or anomalies, and then assess likelihood of it resulting from security risk or attack.

Capabilities

Alerting

Process of informing IT and/or security teams about potential issue.

Potentially assesses severity of each security risk then generates alerts accordingly.

Reporting

HIDS platforms can generate reports about overall state of security within IT environment.

Somethings to consider here are number and types of security risks identified by a HIDS over time, or how security issues can vary across different hosts.

Reports for assessing over-time trends and to demonstrate security posture of organisation.

Response

Sometimes, HIDS tools can carry out certain automated response activities to help remediate risks.

EG: If HIDS determines particular endpoint is trying to probe company servers, it could automatically generate firewall rules ot block probes.

Best Practices

General trend is to maximise security insights from HIDS to minimise management overhead.

• Monitor Everything - Don't limit HIDS to only a few systems. For maximum visibility and understanding of threats, monitor all hosts within network.
• Prioritize Context - HIDS solutions work best when they analyze multiple data sources together. This provides richer context to separate real threats from false alarms.
• Smart Alerting - Only configure alerts for events that truly need attention. Prioritize alerts by severity to focus on the most critical issues.
• Consider Agentless Options - Agentless HIDS can be easier to deploy, manage, and have less impact on system performance.

Limitations

• HIDS are just one layer of security.
• Only specialise in host-based security. Gaps include, vulnerabilities in application source code, public cloud workloads, etc.

HIDS work best in tandem with other security tools and services.