File integrity monitoring (FIM) started back in 1997 when Gene Kim launched Tripwire and its “Change Audit” solution. Just a few years later, Change Audit became FIM; this rebranded tool worked with the 12 security controls identified in Visa’s Cardholder Information Security Program (CISP). CISP became PCI DSS 1.0, and things continued to evolve after that.
Which brings us to the present day. Through our more than two decades of experience, we’ve come to learn that there are some misconceptions still surrounding FIM. It’s imperative that we address those fallacies now so that organizations don’t forsake this security practice and thereby leave themselves exposed to additional risks.
Misconception #1: False Positives
The first misconception is that FIM will generate too many alerts and false positives. Sure, FIM could generate this alert overload…but only if you decide to turn on monitoring for everything. The purpose of FIM is to zero in on critical files like the “system32” folder, and other critical files, including registry entries and the like. If you lease FIM on all your systems, I can guarantee that the monitoring process will become onerous and time-consuming and that it will generate too many alerts.
You can further automate processes here by integrating your FIM capabilities with other security systems such as IT Service Management solutions for change reconciliation. This will help reduce the number of alerts you’ll receive when something does change, thereby enabling your security teams to focus on unauthorized changes without having to deal with too much noise from the network.
Misconception #2: Endpoint Overload
Next, we have the notion that FIM will overload the endpoint. There’s no grounds for that. As an example, Tripwire uses an agent that sits on the endpoint that is optimized. This agent effectively helps Tripwire’s solutions effectively monitor for changes in real-time at low resource cost. At the same time, it helps organizations access other crucial security features like security configuration management (SCM) and maintain their compliance with specific policies and standards, all while experiencing minimal impact on the endpoint.
Misconception #3: Security Posture
Think FIM doesn’t help with an organization’s security posture? That’s not true, either. The whole point of a FIM solution is to make sure that changes occur as the result of a patch or something else that’s legitimate. If the change is unapproved, then an organization can initiate a response against malware or another perceived digital threat. Through this means, organizations can safeguard themselves against zero-day attacks for which there are no known signatures. A FIM tool lets them detect changes and remediate them before they evolve into an incident.
Misconception #4: Context
Another common misconception about file integrity monitoring is the lack of context around detected changes. That might be the case with some “check-box” FIM tools. But it’s not the case with Tripwire. To help customers stay on top of unapproved changes, Tripwire’s FIM solution provides insight into the who, when, where the change was made, and through baselining, Tripwire can identify what changed within the file as well. This information enables users to understand more about a given change so that they can verify whether it’s legitimate or not.
Misconception #5: File Systems
Lastly, you might be inclined to think that FIM monitors only file systems. But that’s not true either. FIM can also monitor the following:
- Databases: On the surface, it might not make sense to monitor a database, especially one that’s changed often. But you can use a FIM tool to monitor a database’s access control lists, schema, database configuration and permissions lists, among other changes. This will help to identify unauthorized individuals accessing the database. Simultaneously, FIM lets you monitor other databases content, that generally remain static.
- Active directory: FIM allows you to monitor changes to any element in Active Directory. For example, monitor group memberships for new users that are added or removed from restricted groups, such as “Domain Admins”. These functionalities give customers visibility over all changes that are made to their directory services.
- Virtual infrastructures: This monitors the host infrastructure for change. For example, a new VM is created, modified or deleted monitoring for if a new virtual machine (VM) is modified, created or deleted.
- Network devices: Using a Command Line Interface (CLI) such as SSH or telnet, you can review firewall rules, access control lists and configurations on network devices such as routers, switches and firewalls. You can then report on what’s changed if there have been any modifications.
- Cloud Storage: Detect changes in cloud storage, such as Amazon S3 Buckets and Azure Blobs for FIM changes.
Tripwire’s FIM Capabilities
The discussion above gave you a taste of what Tripwire’s FIM solution can do. Interested in learning more? If so, check out the recording of my webinar “Uncovering the true intent of File Integrity Monitoring.” In the talk, I elaborate on the misconceptions posted above before diving into a demo of how Tripwire’s FIM tool could have prevented a data breach that gained a great deal of media attention several years ago. I also explain how customers can use what are known as command output capture rules (COCRs) in tandem with Tripwire’s integrated solution suite to further extend the benefits of FIM in their own environments.
For more information, check out the webinar here.