Deploy a Host>Based Intrusion Prevention Solution
Description
Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.
Implementation Checklist
Tool Recommendations
AI-driven network detection and response with self-learning threat analysis and autonomous response
Darktrace · Enterprise subscription
AI-driven threat detection and response for network, cloud, and identity with attack signal intelligence
Vectra AI · Enterprise subscription
Network detection and response platform with real-time traffic analysis, encrypted traffic inspection, and cloud visibility
ExtraHop · Per-device/bandwidth subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Ransomware Execution Despite Detection Alert
AvailabilityA host-based detection tool identifies ransomware behavior but can only alert, not block, allowing the malware to encrypt files before an analyst responds because no host-based prevention capability exists.
Zero-Day Exploit Execution on Endpoint
IntegrityAn attacker delivers a zero-day exploit via a spear-phishing document that executes malicious code on the endpoint, and without host-based intrusion prevention, the exploit cannot be automatically blocked based on behavioral analysis.
Credential Dumping Tool Execution on Compromised Host
ConfidentialityAn attacker runs Mimikatz or similar credential harvesting tools on a compromised workstation, extracting cached credentials without automated prevention because no HIPS/EDR is deployed to block known attack techniques.
Vulnerabilities (When Safeguard Absent)
Detection-Only Capability Without Automated Prevention
Without host-based intrusion prevention, malicious activity identified through detection alone cannot be automatically blocked, creating a gap between alert generation and manual incident response.
No Behavioral-Based Endpoint Blocking
Absence of HIPS or EDR with prevention capabilities means endpoints cannot automatically terminate malicious processes, quarantine suspicious files, or block exploitation techniques in real time.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Incident response plan and playbooks | Reviewed bi-annually |
| Record | Incident reports and post-incident review documentation | Per incident |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |