This may seem like a heck of a statement, but when you are monitoring against a cryptographic value or other attributes (including content), even the slightest deviation is a valid change & that change is detected and processed according to local policy and procedure. File integrity monitoring is an internal control or process that performs the act of validating the current state of a monitored element against a known good baseline. Whether you are seeking a full solution, such as Fortra's Tripwire Enterprise, or a single component, such as the File Integrity Monitoring, your security will take a leap forward. Generally, the act of performing file integrity monitoring is automated using internal controls such as an application or process. This monitoring is important because an integrity event can move an environment out of compliance. For example, combining File Integrity Monitoring (FIM) with Secure Configuration Management, aka Policy Management. It's important to consider what to monitor in your environment, as integrity monitoring can be noisy. Not only am I able to detect change in an environment, change which could ripple out into a security event, I'm also able to understand & manage the security posture of my platforms. If we take a look at other data exfiltration events, they all trace back to integrity monitoring failures. How do we decide what to monitor? What falls under the umbrella of a change audit? There has to be a line of demarcation that satisfies all stakeholders, from the application teams, the security teams, and the operational and governance teams. That's why file integrity monitoring is so important. Integrity monitoring for files is where FIM began; integrity monitoring for "other" is where we are heading. Sometimes, it's serious auditing. Anyone who has enabled C2 database auditing or object access monitoring across a large number of files and directories on a Windows server knows the challenge of reconciling changes. Other file attributes may also be used to monitor integrity. When it comes to monitoring a change to an endpoint, there are no false positives. Integrity management across the ecosystem, across the environment, and not just an endpoint and files, is a great place to build from.
This Cyber News was published on www.tripwire.com. Publication date: Tue, 01 Oct 2024 10:13:06 +0000