Host Based Security System: Difference between revisions

Revision as of 20:57, 26 February 2014

Latest revision as of 00:01, 13 January 2024

(39 intermediate revisions by 31 users not shown)

Line 1:

{{Short description|Department of Defense suite of software applications}}

{{OrphanUpdate|date=June 20112019}}

The '''Host Based Security System''' ('''HBSS''') is the official name given to the United States [[United States Department of Defense|Department of Defense]] (DOD) [[Commercialcommercial off-the-shelf|commercial-off-the-shelf]] (COTS) suite of software applications used within the DOD to monitor, detect, and counterattacks againstdefend the DOD computer networks and systems. The [[Enterprise-wide Information Assurance and computer Network Defense Solutions Steering Group]] (ESSG) sponsored the acquisition of the HBSS System for use within the DOD Enterprise Network. HBSS is deployed on both the [[NIPRNet|Non-Classified Internet Protocol Routed Network]] (NIPRNet) and [[SIPRNet|Secret Internet Protocol Routed Network]] (SIPRNet) networks, with priority given to installing it on the NIPRNet. HBSS is based on [[McAfee|McAfee, Inc]]'s [[ePolicy Orchestrator]] (ePO) and other McAfee point product security applications such as [[Host Intrusion Prevention System]] (HIPS).

== History ==

Seeing the need to supply a comprehensive, department-wide security suite of tools for DOD System Administrators, the ESSG started to gather requirements for the formation of a host-based security system in the summer of 2005. In March 2006, [[BAE Systems]] and McAfee were awarded a contract to supply an automated host-based security system to the department. After the award, 22 pilot sites were identified to receive the first deployments of HBSS.<ref>''{{Cite web|date=2010-06-19|title=Host Based Security System'', (HBSS)|url=http://www.disa.mil/hbss/index.html, 3|access-date=2021-08-18|archive-url=https:/13/web.archive.org/web/20100619104318/http://www.disa.mil/hbss/index.html|archive-date=2010-06-19}}</ref> During the pilot roll out, DOD System Administrators around the world were identified and trained on using the HBSS software in preparation for software deployment across DOD.

On October 9, 2007, the [[Joint Task Force for Global Network Operations]] (JTF-GNO) released [[Communications Tasking Order]] (CTO) 07-12 (''Deployment of Host Based Security System (HBSS)'') mandating the deployment of HBSS on all Combatant Command, Service and Agency (CC/S/A) networks within DOD with the completion date by the 3rd quarter of 2008.<ref>''Host{{Cite Based Security System HBSS)'',web|date=2010-12-05|title=infoexchange|url=http://www.afcea.org/events/landwarnet/08/infoexchange.asp, 3|access-date=2021-08-18|archive-url=https:/13/web.archive.org/web/20101205013909/http://www.afcea.org/events/landwarnet/08/infoexchange.asp|archive-date=2010-12-05}}</ref> The release of this CTO brought HBSS to the attention of all major department heads and CC/S/A's, providing the ESSG with the necessary authority to enforce its deployment. Agencies not willing to comply with the CTO now risked being disconnected from the DOD [[Global Information Grid]] (GIG) for any lack of compliance.

Lessons learned from the pilot deployments provided valuable insight to the HBSS program, eventually leading to the [[Defense Information Systems Agency]] (DISA) supplying both pre-loaded HBSS hardware as well as providing an HBSS software image that could be loaded on compliant hardware platforms. This proved to be invaluable to easing the deployment task on the newly trained HBSS System Administrators and provided a consistent department-wide software baseline. DISA further provided step-by-step documentation for completing an HBSS baseline creation from a freshly installed operating system. The lessons learned from the NIPRNet deployments simplified the process of deploying HBSS on the SIPRNet.

=== Significant HBSS Datesdates ===

* Summer 2005: ESSG gathered information on establishing an HBSS automated system

* March 2006: BAE Systems and McAfee awarded contract for HBSS establishment and deployment

* March 27, 2007: The ESSG approved the HBSS for full-scale deployment throughout the DoD enterprise

* October 9, 2007: The [[Joint Task Force for Global Network Operations|JTF-GNO]] releases CTO 07-12

* November, 2009: The [[United States Air Force|Air Force]] awarded [[Northrop Grumman|Northrop Grumman, Inc.]] with the deployment of HBSS on the SIPRNet<ref>Henry Kenyon, ''Northrop Grumman Wins Air Force SIPRNET Contract'', http://www.afcea.org/signal/signalscape/index.php/2009/11/northrop-grumman-wins-air-force-siprnet-contract/, 3/13/2010 {{Dead link|date=August 2021}}</ref>

== HBSS Componentscomponents ==

Throughout its lifetime, HBSS has undergone several major baseline updates as well as minor maintenance releases. The first major release of HBSS was known as Baseline 1.0 and contained the McAfee ePolicy Orchestratororchestrator engine, HIPS, [[Softwaresoftware Compliancecompliance Profilerprofiler]] (SCP), [[Roguerogue Systemsystem Detectiondetection]] (RSD), [[Assetasset Baselinebaseline Managermanager]] (ABM), and [[Assets]]assets software. As new releases were introduced, these software products have evolved, had new products added, and in some cases, been completely replaced for different products.

=== HBSS Baseline 4.5 MR2 components ===
As of January, 2011, HBSS is currently at Baseline 4.5, Maintenance Release 2.0 (MR2). MR2 contains the following software:

==== Microsoft Productsproducts ====

=== HBSS Baseline 4.5 MR2 Components ===

{| class="wikitable collapsible" style="width:100%;"

|-

! Software Applicationapplication

! As of January, 2011, HBSS is currently at Baseline 4.5, Maintenance Release 2.0 (MR2). MR2 contains the following software:

|-

| <div style="height: 500px;overflow:-moz-scrollbars-vertical;overflow-y:auto;">

==== Microsoft Products ====

{| class=redtable border=1

|-

! Software Application

! Version

|-

Line 38 ⟶ 32:

| 2003 SP2 (5.2.3790)

|-

| Microsoft .NET Frameworkframework

| 1.1.4322.2433

|-

| Microsoft .NET Frameworkframework

| 2.2.30729

|-

| Microsoft .NET Frameworkframework

| 3.2.30729

|-

| Microsoft .NET Frameworkframework

| 3.5.30729.1

|-

Line 57 ⟶ 51:

|}

==== Optional Productsproducts/Componentscomponents ====

{| class=redtable border=1wikitable

|-

! Software Applicationapplication

! Version

|-

| Symantec SEP/SAV Integrationintegration Extensionextension

| 1.3, plugin 1.2666

|-

| McAfee VirusScan Enterprise

| 8.7.0.570 (Evaluationevaluation)

|-

| McAfee VirusScan Enterprise 8.7 Extensionextension

| 8.7.0.195

|-

| McAfee VirusScan Reportreport Extensionextension

| 1.1.0.154

|}

==== SIPRNet-only Only Productsproducts/Componentscomponents ====

{| class=redtable border=1wikitable

|-

! Software Applicationapplication

! Version

|-

Line 87 ⟶ 81:

| Rollup Extender

| 1.2.8

|}

</div>

|}

== How HBSS Worksworks ==

The heart of the HBSS is the McAfee ePolicy Orchestratororchestrator (ePO) management engine. The engineMcAfee istools are responsible for:

* Providing a consistent front-end to the point products

* Consolidating point product data for analysis

Line 99 ⟶ 91:

* Ensure application patch compliance

<!----==== Security Compliancecompliance Profilerprofiler ====

The Securitysecurity Compliancecompliance Profilerprofiler (SCP) was one of the original products provided in HBSS Baseline 1.0. It was removed from HBSS as of Baseline 2.0 and replaced with the Policypolicy Auditorauditor component. The SCP is an integral component of ePO that provides enterprise-wide reporting on security patches, including the Microsoft® operating systems.<ref>'''System Compliance Profiler''', http://www.mcafee.com/us/enterprise/products/promos/system_security_management/epolicy_orchestrator/compliance_profiler.html, 3/14/2010</ref>

---->

=== McAfee Pointpoint Productsproducts ===

McAfee considers a point product to be the individual software applications controlled by the ePO server. The HBSS point products consist of the following:

* Host Intrusionintrusion Preventionprevention Systemsystem (HIPS)

* Policy Auditorauditor (PA)

* Assets Baselinebaseline Modulemodule (ABM)

* Rogue Systemsystem Detectiondetection (RSD)

* Device Controlcontrol Modulemodule (DCM)

* Asset Publishingpublishing Serviceservice (APS)

==== Host Intrusionintrusion Preventionprevention Systemsystem ====

The Hosthost Intrusionintrusion Preventionprevention Systemsystem (HIPS) consists of a host-based firewall and application-level blocking consolidated in a single product. The HIPS component is one of the most significant components of the HBSS, as it provides for the capability to block known intrusion signatures and restrict unauthorized services and applications running on the host machines.

==== Policy Auditorauditor ====

Policy Auditorauditor (PA) was introduced in HBSS Baseline 2.0. Policy Auditorauditor is responsible for ensuring compliance with mandates such as: [[Payment Card Industry Data Security Standard]] (PCI DSS), [[Sarbanes–Oxley Act of 2002]] (SOX), [[Gramm–Leach–Bliley Act]] of 1999 (GLBA), [[Health Insurance Portability and Accountability Act of 1996]] (HIPAA), [[Federal Information Security Management Act of 2002]] (FISMA), as well as the best practice frameworks [[ISO 27001:2005]] and Control Objectives for Information and Relatedrelated Technologytechnology ([[COBIT]]). PA maps IT controls against predefined policy content, McAfee Policy Auditor helps report consistently and accurately against key industry mandates and internal policies across your infrastructure or on specific targeted systems. Policy Auditor is an agent-based IT audit solution that leverages the Security Content Automation Protocol (SCAP) to automate the processes required for internal and external IT audits.<ref>{{cite web|title=McAfee Policy Auditor|url=http://www.mcafee.com/us/products/policy-auditor.aspx|accessdate=15 November 2012}}</ref>

==== Assets baseline Baseline Modulemodule ====

The Assetsassets Baselinebaseline Modulemodule, released in Baseline 1.0 as a [[Governmentgovernment off-the-shelf]] (GOTS) product, is used to address system baseline configurations and changes in order to respond to [[INFOCON|Informationinformation Operationsoperations Conditioncondition (INFOCON)]] (INFOCON) changes necessary during times of heightened security threats to the system. During the initial deployment stages of HBSS, the Assetsassets Modulemodule was juvenile and lacked much of the products intended capabilities. However, the application has fully evolved into a robust and feature packed version capable of handling the original software's design goals. ABM was originally known as Assets 1.0. It was upgraded to Assets 2.0 in HBSS Baseline 2.0. Later it was called Assets 3000 in HBSS Baseline 3.0.

==== Rogue Systemsystem Detectiondetection ====

The Roguerogue Systemsystem Detectordetector (RSD) component of HBSS is used to provide real-time detection of new hosts attaching to the network. RSD monitors network segments and reports all hosts seen on the network to the ePO Server. The ePO Server then determines whether the system is connected to the ePO Serverserver, has a McAfee Agentagent installed, has been identified as an exception, or is considered rogue. The ePO Serverserver can then take the appropriate action(s) concerning the rogue host, as specified in the RSD policy. HBSS Baseline 1.0 introduced RSD 1.0. RSD was updated to 2.0 in HBSS Baseline 2.0.

==== Device Controlcontrol Modulemodule/Datadata Lossloss Preventionprevention ====

The DCM component of HBSS was introduced in HBSS Baseline 2.0 specifically to address the use of USB devices on DOD Networksnetworks. JTF-GNO CTO 09-xxx, ''Removableremovable Flashflash Mediamedia Devicedevice Implementationimplementation Withinwithin and Betweenbetween Department of Defense (DOD) Networksnetworks'' was released in March, 2009 and allowed the use of USB removable media, provided it meets all of the conditions stated within the CTO. One of these conditions requires the use of HBSS with the DCM module installed and configured to manage the USB devices attached to the system.<ref>Tom{{Cite Conway, ''DODweb|date=2011-01-20|title=DoD Can Safely Use USB'', Securely {{!}} Blog Central|url=http://blogs.mcafee.com/enterprise/public-sector/dod-can-use-usb-securely, (Security Insights Blog), 3|access-date=2021-08-18|archive-url=https:/9/2010web.archive.org/web/20110120192355/http://blogs.mcafee.com/enterprise/public-sector/dod-can-use-usb-securely|archive-date=2011-01-20}}</ref> The DCM was renamed to the Datadata Lossloss Preventionprevention (DLP) in HBSS Baseline 3.0 MR3.

==== Assets Publishingpublishing Serviceservice ====

The Assetsassets Publishingpublishing Serviceservice (APS) of HBSS was introduced in HBSS Baseline 4.0 to allow for enclaves to report on asset information to a third-party DoD entity in a standards-compliant format. It adds contextual information to HBSS assets and allows for improved reporting features on systems relying on HBSS data.

== Obtaining HBSS ==

According to JTF-GNO CTO 07-12, all DOD agencies are required to deploy HBSS to their networks. DISA has made HBSS software available for download on their [[Public key infrastructure|PKI]] protected [https://patches.csd.disa.mil/ patch server]. Users attempting to download the software are required to have a [[Common Access Card]] (CAC) and be on a .mil network. DISA provides software and updates free of charge to DOD entities.

Additionally, HBSS Administratorsadministrators require the satisfactory completion of HBSS training and are commonly appointed by the unit or section commander in writing.

== Learning HBSS ==

In order to receive and administer an HBSS Systemsystem, Systemsystem Administratorsadministrators must satisfactorily complete online or in class HBSS Trainingtraining as well as be identified as an HBSS Administratoradministrator. Online training takes 30 hours to complete while in class training requires four days, excluding travel. An advanced HBSS class is also available to HBSS Administratorsadministrators wishing to acquire a more in-depth knowledge of the system. HBSS online and in class training is managed by DISA and information pertaining to these training classes can be obtained at the DISA [http://iase.disa.mil Information Assurance Support Environment] (IASE) website.

== HBSS Supportsupport ==

The DISA Risk Management Executive Office (RE) formerly [[Fieldfield Securitysecurity Officeoffice]] (FSO) provides free technical support for all HBSS Administrators through their help desk. DISA has three tiers of support, from Tier I to Tier III. Tier I and Tier II support is provided by DISA FSO, while Tier III support is provided by McAfee. DISA FSO Support is available using one of the following methods:<ref>''IA{{Cite Tools'',web|date=2010-02-12|title=DoD Information Assurance Tools|url=http://iase.disa.mil/tools/index.html, 3|access-date=2021-08-18|archive-url=https:/14/web.archive.org/web/20100212232302/http://iase.disa.mil/tools/index.html|archive-date=2010-02-12}}</ref>

{|

|Email: disa.tinker.eis.mbx.cdk21-esmosthbss-service-desk [at] csd.disamail.mil

|-

|Commercial [phone]

|-

|[[Defense Switched Network|DSN]]: 339850-56000032

|-

|Toll Free: 800844-490347-16432457

|}

== The Futurefuture of HBSS ==

At its current pace, HBSS has been updated several times from the original Baseline 1.0 to the current Baseline 3.0, MR3 version. Within Baseline 3.0, maintenance releases have been introduced every two to four months, bringing better stability and security with each release. HBSS follows McAfee ePO version updates closely and it is expected to continue this trend as ePO is continuously developed.

== References ==

<!--- See http://en.wikipedia.org/wiki/Wikipedia:Footnotes on how to create references using <ref></ref> tags which will then appear here automatically -->

{{Reflist}}

== External links ==

* [http://www.afcea.org/signal/articles/templates/200904SIGNALConnections.asp?articleid=1909&zoneid=258 End-Point Security Spreads Throughout Military]

* [http://www.afcea.org/signal/signalscape/index.php/2009/11content/?q=northrop-grumman-wins-air-force-siprnet-contract/ Northrop Grumman Wins Air Force SIPRNET Contract ]

* [http://www.afcea.org/events/landwarnet/08/infoexchange.asp Host Based Security System (HBSS)]

* [http://iase.disa.mil Information Assurance Support Environment]

* [http://www.mcafee.com McAfee, Inc.]