Host Based Security System The Host Based Security System ( HBSS ) is the official name given to the Department of Defense ( DOD ) commercial - off - the - shelf ( COTS ) suite of software applications used within the DOD to monitor , detect , and counter attacks against the DOD computer networks and systems . The Enterprise - wide Information Assurance and computer Network Defense Solutions Steering Group ( ESSG ) sponsored the acquisition of the HBSS System for use within the DOD Enterprise Network . HBSS is deployed on both the Non - Classified Internet Protocol Routed Network ( NIPRNet ) and Secret Internet Protocol Routed Network ( SIPRNet ) networks , with priority given to installing it on the NIPRNet . HBSS is based on McAfee , Inc ' s ePolicy Orchestrator ( ePO ) and other McAfee point product security applications such as Host Intrusion Prevention System ( HIPS ) . History . Seeing the need to supply a comprehensive , department - wide security suite of tools for DOD System Administrators , the ESSG started to gather requirements for the formation of a host - based security system in the summer of 2005 . In March 2006 , BAE Systems and McAfee were awarded a contract to supply an automated host - based security system to the department . After the award , 22 pilot sites were identified to receive the first deployments of HBSS . During the pilot roll out , DOD System Administrators around the world were identified and trained on using the HBSS software in preparation for software deployment across DOD . On October 9 , 2007 , the Joint Task Force for Global Network Operations ( JTF - GNO ) released Communications Tasking Order ( CTO ) 07 - 12 ( " Deployment of Host Based Security System ( HBSS ) " ) mandating the deployment of HBSS on all Combatant Command , Service and Agency ( CC / S / A ) networks within DOD with the completion date by the 3rd quarter of 2008 . The release of this CTO brought HBSS to the attention of all major department heads and CC / S / A ' s , providing the ESSG with the necessary authority to enforce its deployment . Agencies not willing to comply with the CTO now risked being disconnected from the DOD Global Information Grid ( GIG ) for any lack of compliance . Lessons learned from the pilot deployments provided valuable insight to the HBSS program , eventually leading to the Defense Information Systems Agency ( DISA ) supplying both pre - loaded HBSS hardware as well as providing an HBSS software image that could be loaded on compliant hardware platforms . This proved to be invaluable to easing the deployment task on the newly trained HBSS System Administrators and provided a consistent department - wide software baseline . The DISA further provided step - by - step documentation for completing an HBSS baseline creation from a freshly installed operating system . The lessons learned from the NIPRNet deployments simplified the process of deploying HBSS on the SIPRNet . HBSS Components . Throughout its lifetime , HBSS has undergone several major baseline updates as well as minor maintenance releases . The first major release of HBSS was known as Baseline 1 . 0 and contained the McAfee ePolicy Orchestrator engine , HIPS , Software Compliance Profiler ( SCP ) , Rogue System Detection ( RSD ) , Asset Baseline Manager ( ABM ) , and Assets software . As new releases were introduced , these software products have evolved , had new products added , and in some cases , been completely replaced for different products . As of January , 2011 , HBSS is currently at Baseline 4 . 5 , Maintenance Release 2 . 0 ( MR2 ) . MR2 contains the following software : How HBSS Works . The heart of the HBSS is the McAfee ePolicy Orchestrator ( ePO ) management engine . The engine is responsible for : McAfee Point Products . McAfee considers a point product to be the individual software applications controlled by the ePO server . The HBSS point products consist of the following : Host Intrusion Prevention System . The Host Intrusion Prevention System ( HIPS ) consists of a host - based firewall , HIPS , and application - level blocking consolidated in a single product . The HIPS component is one of the most significant components of the HBSS , as it provides for the capability to block known intrusion signatures and restrict unauthorized services and applications running on the host machines . Policy Auditor . Policy Auditor ( PA ) was introduced in HBSS Baseline 2 . 0 . Policy Auditor is responsible for ensuring compliance with mandates such as : Payment Card Industry Data Security Standard ( PCI DSS ) , Sarbanes – Oxley Act of 2002 ( SOX ) , Gramm – Leach – Bliley Act of 1999 ( GLBA ) , Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) , Federal Information Security Management Act of 2002 ( FISMA ) , as well as the best practice frameworks and Control Objectives for Information and Related Technology ( COBIT ) . PA maps IT controls against predefined policy content , McAfee Policy Auditor helps report consistently and accurately against key industry mandates and internal policies across your infrastructure or on specific targeted systems . Policy Auditor is an agent - based IT audit solution that leverages the Security Content Automation Protocol ( SCAP ) to automate the processes required for internal and external IT audits . Assets Baseline Module . The Assets Baseline Module , released in Baseline 1 . 0 as a Government off - the - shelf ( GOTS ) product , is used to address system baseline configurations and changes in order to respond to Information Operations Condition ( INFOCON ) ( INFOCON ) changes necessary during times of heightened security threats to the system . During the initial deployment stages of HBSS , the Assets Module was juvenile and lacked much of the products intended capabilities . However , the application has fully evolved into a robust and feature packed version capable of handling the original software ' s design goals . ABM was originally known as Assets 1 . 0 . It was upgraded to Assets 2 . 0 in HBSS Baseline 2 . 0 . Later it was called Assets 3000 in HBSS Baseline 3 . 0 . Rogue System Detection . The Rogue System Detector ( RSD ) component of HBSS is used to provide real - time detection of new hosts attaching to the network . RSD monitors network segments and reports all hosts seen on the network to the ePO Server . The ePO Server then determines whether the system is connected to the ePO Server , has a McAfee Agent installed , has been identified as an exception , or is considered rogue . The ePO Server can then take the appropriate action ( s ) concerning the rogue host , as specified in the RSD policy . HBSS Baseline 1 . 0 introduced RSD 1 . 0 . RSD was updated to 2 . 0 in HBSS Baseline 2 . 0 . Device Control Module / Data Loss Prevention . The DCM component of HBSS was introduced in HBSS Baseline 2 . 0 specifically to address the use of USB devices on DOD Networks . JTF - GNO CTO 09 - xxx , " Removable Flash Media Device Implementation Within and Between Department of Defense ( DOD ) Networks " was released in March , 2009 and allowed the use of USB removable media , provided it meets all of the conditions stated within the CTO . One of these conditions requires the use of HBSS with the DCM module installed and configured to manage the USB devices attached to the system . The DCM was renamed to the Data Loss Prevention ( DLP ) in HBSS Baseline 3 . 0 MR3 . Assets Publishing Service . The Assets Publishing Service ( APS ) of HBSS was introduced in HBSS Baseline 4 . 0 to allow for enclaves to report on asset information to a third - party DoD entity in a standards - compliant format . It adds contextual information to HBSS assets and allows for improved reporting features on systems relying on HBSS data . Obtaining HBSS . According to JTF - GNO CTO 07 - 12 , all DOD agencies are required to deploy HBSS to their networks . The DISA has made HBSS software available for download on their PKI protected patch server . Users attempting to download the software are required to have a Common Access Card ( CAC ) and be on a . mil network . The DISA provides software and updates free of charge to DOD entities . Additionally , HBSS Administrators require the satisfactory completion of HBSS training and are commonly appointed by the unit or section commander in writing . Learning HBSS . In order to receive and administer an HBSS System , System Administrators must satisfactorily complete online or in class HBSS Training as well as be identified as an HBSS Administrator . Online training takes 30 hours to complete while in class training requires four days , excluding travel . An advanced HBSS class is also available to HBSS Administrators wishing to acquire a more in - depth knowledge of the system . HBSS online and in class training is managed by the DISA and information pertaining to these training classes can be obtained at the DISA Information Assurance Support Environment ( IASE ) website . HBSS Support . The DISA Field Security Office ( FSO ) provides free technical support for all HBSS Administrators through their help desk . DISA has three tiers of support , from Tier I to Tier III . Tier I and Tier II support is provided by DISA FSO , while Tier III support is provided by McAfee . DISA FSO Support is available using one of the following methods : The Future of HBSS . At its current pace , HBSS has been updated several times from the original Baseline 1 . 0 to the current Baseline 3 . 0 , MR3 version . Within Baseline 3 . 0 , maintenance releases have been introduced every two to four months , bringing better stability and security with each release . HBSS follows McAfee ePO version updates closely and it is expected to continue this trend as ePO is continuously developed .