TABLE OF CONTENTS This special Appendix is excerpted from Brian Wotring s book, Host Integrity Monitoring Using Osiris and Samhain (Syngress Publishing, ISBN: 1 597490 18 0).
HIM is the recurring assessment of a host s environment based on a known good state or policy. A host can be a home user s PC, a corporate e-mail or Web server, a production build system, or a computer in an Internet caf . A host can also be a router or a switch.
As shown in Figure A.1, a host s environment can be broken down into three categories: files, configurations, and runtime. Files are the most obvious and include the content and attributes associated with individual files as well as the file systems themselves. The configurations of an environment are higher-level elements such as users and groups, access control, configurations for services, and basically anything that dictates the initial state of the system. The runtime involves the dynamics of a running system such as the state of a network stack (e.g., open ports), user login/logout activities, kernel state (e.g., extensions, services, drivers), system resources such as memory, and the running process table.
The overall goal is to detect and report on changes in the environment. However, things get tricky when we try to establish which of the detected changes are good, and which are not. Enter the concept of integrity. It may be that a change seems perfectly reasonable on one host, but suspect on another. For example, adding an...
