MISCONCEPTION #1: FALSE POSITIVESThe first misconception is that FIM will generate too many alerts and false positives. Sure, FIM could generate this alert overload…but only if you decide to turn on monitoring for everything. The purpose of FIM is to zero in on critical files like the “system32” folder, and other critical files, including registry entries and the like. If you implement FIM on all your systems, I can guarantee that the monitoring process will become onerous and time-consuming and that it will generate too many alerts. You can further automate processes here by integrating your FIM capabilities with other security systems such as IT Service Management solutions for change reconciliation. This will help reduce the number of alerts you will receive when something does change, thereby enabling your security teams to focus on unauthorized changes without having to deal with too much noise from the network.
MISCONCEPTION #2: ENDPOINT OVERLOADNext, we have the notion that FIM will overload the endpoint. There is no grounds for that. As an example, Tripwire uses an agent that sits on the endpoint that is optimized. This agent effectively helps Tripwire’s solutions effectively monitor for changes in real-time at low resource cost. At the same time, it helps organizations access other crucial security features like security configuration management (SCM) and maintain their compliance with specific policies and standards, all while experiencing minimal impact on the endpoint.
MISCONCEPTION #3: SECURITY POSTUREThink FIM does not help with an organization’s security posture? That is not true, either. The whole point of a FIM solution is to make sure that changes occur as the result of a patch or something else that is legitimate. If the change is unapproved, then an organization can initiate a response against malware or another perceived digital threat. Through this means, organizations can safeguard themselves against zero-day attacks for which there are no known signatures. A FIM tool lets them detect changes and remediate them before they evolve into an incident.
MISCONCEPTION #4: CONTEXTAnother common misconception about file integrity monitoring is the lack of context around detected changes. That might be the case with some “check-box” FIM tools. But it is not the case with Tripwire. To help customers stay on top of unapproved changes, Tripwire’s FIM solution provides insight into the who, when, where the change was made, and through baselining, Tripwire can identify what changed within the file as well. This information enables users to understand more about a given change so that they can verify whether it is legitimate or not.
MISCONCEPTION #5: FILE SYSTEMSLastly, you might be inclined to think that FIM monitors only file systems. But that is not true either. FIM can also monitor the following:
- Databases: On the surface, it might not make sense to monitor a database, especially one that is changed often. But you can use a FIM tool to monitor a database’s access control lists, schema, database configuration and permissions lists, among other changes. This will help to identify unauthorized individuals accessing the database. Simultaneously, FIM lets you monitor other databases content, that generally remain static.
- Active directory: FIM allows you to monitor changes to any element in Active Directory. For example, monitor group memberships for new users that are added or removed from restricted groups, such as “Domain Admins”. These functionalities give customers visibility over all changes that are made to their directory services.
- Virtual infrastructures: This monitors the host infrastructure for change. For example, a new VM is created, modified, or deleted monitoring for if a new virtual machine (VM) is modified, created, or deleted.
- Network devices: Using a Command Line Interface (CLI) such as SSH or telnet, you can review firewall rules, access control lists and configurations on network devices such as routers, switches, and firewalls. You can then report on what is changed if there have been any modifications.
- Cloud Storage: Detect changes in cloud storage, such as Amazon S3 Buckets and Azure Blobs for FIM changes.