GSEC · Question #247
What is a limitation of deploying HIPS on a workstation?
The correct answer is C. Restricted support for custom applications. Host Intrusion Prevention Systems rely on behavioral rules and signatures that may not account for the unique runtime behavior of custom or in-house developed applications, causing conflicts or missed detections.
Question
What is a limitation of deploying HIPS on a workstation?
Options
- ARequires more frequent system patching
- BRequires an HIDS to Identify an attack
- CRestricted support for custom applications
- DRuns as a non-privileged user
How the community answered
(22 responses)- A14% (3)
- B5% (1)
- C73% (16)
- D9% (2)
Why each option
Host Intrusion Prevention Systems rely on behavioral rules and signatures that may not account for the unique runtime behavior of custom or in-house developed applications, causing conflicts or missed detections.
HIPS does not inherently increase the frequency of system patching requirements; patch management is a separate administrative process independent of HIPS operation.
HIPS is capable of both detecting and preventing attacks autonomously without requiring a separate HIDS component, as it combines detection logic with active blocking capabilities.
HIPS monitors application behavior by intercepting system calls and comparing activity against predefined policy rules. Custom applications with non-standard behavior patterns often trigger false positives or require extensive manual rule creation that vendor-provided policies do not cover, making HIPS difficult to deploy effectively in environments with proprietary software.
HIPS must run with elevated privileges to intercept kernel-level and system calls; running as a non-privileged user would prevent it from functioning correctly.
Concept tested: HIPS limitations with custom application support
Source: https://csrc.nist.gov/publications/detail/sp/800-94/final
Topics
Community Discussion
No community discussion yet for this question.