File integrity monitoring (FIM) started back in 1997 when Jin Kim launched Tripwire and its “Change Audit” solution. Just a few years later, Change Audit became FIM; this rebranded tool has been running since 12 security control defined in VisaCardholder Information Security Program (CISP). CISP became PCI DSS 1.0 and things continued to evolve after that.
Which brings us to today. Through more than two decades of experience, we have learned that there are still some misconceptions surrounding FIM. It is critical that we address these mistakes now so that organizations do not abandon these security practices and thereby expose themselves to additional risks.
MISTAKE #1: FALSE POSITIVES
The first misconception is that FIM will generate too many alerts and false positives. Sure, FIM can create this warning overload…but only if you choose to enable monitoring for everything. The purpose of FIM is to concentrate critical files, such as the “system32” folder, and other important files, including registry entries, etc. If you implement FIM in all your systems, I can guarantee that the monitoring process will become difficult and time consuming and that it will generate too many alerts.
Here, you can further automate processes by integrating your FIM capabilities with other security systems, such as IT service management solutions for change reconciliation. This will help reduce the number of alerts you receive when something does change, thereby allowing your security teams to focus on unauthorized changes without having to deal with too much network noise.
ERROR #2: ENDPOINT OVERLOAD
Next, we believe that FIM will overload the endpoint. There is no reason for this. As an example, Tripwire uses an agent that resides on an optimized endpoint. This agent effectively helps Tripwire solutions effectively track changes in real-time at low resource costs. At the same time, it helps organizations access other important security features, e.g security configuration management (SCM) and maintain their compliance with specific policies and standards while experiencing minimal impact on the endpoint.
MISTAKE #3: SAFETY POSTURE
Think FIM doesn’t help keep your organization safe? This is also not true. The whole point of the FIM solution is to make sure that the change comes from a patch or something else that is legitimate. If the change is not approved, the organization may initiate a response against malware or another suspected digital threat. With this tool, organizations can protect themselves against zero-day attacks for which there are no known signatures. The FIM tool allows them to identify changes and correct them before they escalate into an incident.
MISTAKE #4: CONTEXT
Another common misconception about file integrity monitoring it’s the lack of context around the identified changes. This may be the case with some of the FIM tools’ “check boxes”. But that’s not the case with Tripwire. To help customers stay on top of unapproved changes, Tripwire’s FIM solution provides visibility into who, when and where changes were made, and through a baseline, Tripwire can also determine what changed in a file. This information allows users to better understand a given change so they can check whether it is legitimate or not.
MISTAKE #5: FILE SYSTEMS
Finally, you might be inclined to think that FIM only monitors file systems. But this is also not true. FIM can also monitor the following:
- Databases: At first glance, it may not make sense to keep track of a database, especially one that changes frequently. But you can use the FIM tool to monitor database access control lists, schema, database configuration, and permission lists, among other changes. This will help detect unauthorized access to the database. At the same time, FIM allows you to control the content of other databases that normally remain static.
- Active catalog: FIM allows you to monitor changes to any item in Active Directory. For example, track group memberships for new users who are added to or removed from restricted groups such as Domain Admins. These functionalities allow customers to see all changes made to their directory services.
- Virtual infrastructures: This monitors the host infrastructure for changes. For example, a new virtual machine is created, modified, or deleted, monitoring that a new virtual machine (VM) is modified, created, or deleted.
- Network devices: Using a command-line interface (CLI) such as SSH or telnet, you can view firewall rules, access control lists, and configurations of network devices such as routers, switches, and firewalls. You can then report what has changed, if any.
- Cloud Storage: Detect changes in cloud repositories such as Amazon S3 Buckets and Azure Blobs for FIM changes.
FIM Tripwire capabilities
Tripwire File Integrity Monitoring (FIM) has a unique built-in ability to reduce noise by providing multiple ways to distinguish low-risk changes from high-risk changes as part of the assessment, prioritization, and reconciliation of identified changes. Pushing countless changes automatically on a routine basis reduces the noise, so IT has more time to study changes that could really impact security and create risk.
Tripwire uses agents to continuously collect detailed who, what, and when information in real-time to ensure that you detect all changes, capture detailed information about each one, and use this information to identify security risks or non-compliance.