About the Access Appliance intrusion detection system
The Access appliance uses Symantec Data Center Security: Server Advanced (SDCS) software to monitor appliance software components for unauthorized access. SDCS is a security solution offered by Symantec to protect servers in data centers and is automatically configured during appliance software installation.
SDCS offers policy-based protection and helps secure the appliance using host-based intrusion detection technology. The SDCS agent launches automatically at startup and enforces the customized Access appliance intrusion detection system (IDS) policy. The IDS policy operates in real time for monitoring significant system events and critical configuration changes. This solution provides enhanced visibility into important user or system actions to ensure a valid and complete audit trail that addresses compliance regulations (such as PCI) as a compensating control.
The following list contains some of the events that the IDS policy monitors:
User logons, logouts, and failed logon attempts
sudo commands
User addition, deletion, and password changes
User group addition, deletion, and member modifications
System auto-start option changes
Modifications to all system directories and files, including core system files, core system configuration files, installation programs, and common daemon files
Access services start and stop
File and directory behavior to detect rootkits, worms, malicious modules, suspicious permission changes, etc.
Audit of all the activity in the Access Appliance shell menu, including the shell operations by the maintenance and root users.