Dispelling 5 Myths and Misconceptions Surrounding File Integrity Monitoring (FIM)

Image

File integrity monitoring (FIM) started back in 1997 when Gene Kim launched Tripwire and its “Change Audit” solution. Just a few years later, Change Audit became FIM; this rebranded tool worked with the 12 security controls identified in Visa’s Cardholder Information Security Program (CISP). CISP became PCI DSS 1.0, and things continued to evolve after that. Which brings us to the present day. Through our more than two decades of experience, we have come to learn that there are some misconceptions still surrounding FIM. It is imperative that we address those fallacies now so that organizations do not forsake this security practice and thereby leave themselves exposed to additional risks.

MISCONCEPTION #1: FALSE POSITIVES

The first misconception is that FIM will generate too many alerts and false positives. Sure, FIM could generate this alert overload…but only if you decide to turn on monitoring for everything. The purpose of FIM is to zero in on critical files like the “system32” folder, and other critical files, including registry entries and the like. If you implement FIM on all your systems, I can guarantee that the monitoring process will become onerous and time-consuming and that it will generate too many alerts. You can further automate processes here by integrating your FIM capabilities with other security systems such as IT Service Management solutions for change reconciliation. This will help reduce the number of alerts you will receive when something does change, thereby enabling your security teams to focus on unauthorized changes without having to deal with too much noise from the network.

MISCONCEPTION #2: ENDPOINT OVERLOAD

Next, we have the notion that FIM will overload the endpoint. There is no grounds for that. As an example, Tripwire uses an agent that sits on the endpoint that is optimized. This agent effectively helps Tripwire’s solutions effectively monitor for changes in real-time at low resource cost. At the same time, it helps organizations access other crucial security features like security configuration management (SCM) and maintain their compliance with specific policies and standards, all while experiencing minimal impact on the endpoint.

MISCONCEPTION #3: SECURITY POSTURE

Think FIM does not help with an organization’s security posture? That is not true, either. The whole point of a FIM solution is to make sure that changes occur as the result of a patch or something else that is legitimate. If the change is unapproved, then an organization can initiate a response against malware or another perceived digital threat. Through this means, organizations can safeguard themselves against zero-day attacks for which there are no known signatures. A FIM tool lets them detect changes and remediate them before they evolve into an incident.

MISCONCEPTION #4: CONTEXT

Another common misconception about file integrity monitoring is the lack of context around detected changes. That might be the case with some “check-box” FIM tools. But it is not the case with Tripwire. To help customers stay on top of unapproved changes, Tripwire’s FIM solution provides insight into the who, when, where the change was made, and through baselining, Tripwire can identify what changed within the file as well. This information enables users to understand more about a given change so that they can verify whether it is legitimate or not.

MISCONCEPTION #5: FILE SYSTEMS

Lastly, you might be inclined to think that FIM monitors only file systems. But that is not true either. FIM can also monitor the following:

• Databases: On the surface, it might not make sense to monitor a database, especially one that is changed often. But you can use a FIM tool to monitor a database’s access control lists, schema, database configuration and permissions lists, among other changes. This will help to identify unauthorized individuals accessing the database. Simultaneously, FIM lets you monitor other databases content, that generally remain static.
• Active directory: FIM allows you to monitor changes to any element in Active Directory. For example, monitor group memberships for new users that are added or removed from restricted groups, such as “Domain Admins”. These functionalities give customers visibility over all changes that are made to their directory services.
• Virtual infrastructures: This monitors the host infrastructure for change. For example, a new VM is created, modified, or deleted monitoring for if a new virtual machine (VM) is modified, created, or deleted.
• Network devices: Using a Command Line Interface (CLI) such as SSH or telnet, you can review firewall rules, access control lists and configurations on network devices such as routers, switches, and firewalls. You can then report on what is changed if there have been any modifications.
• Cloud Storage: Detect changes in cloud storage, such as Amazon S3 Buckets and Azure Blobs for FIM changes.

Tripwire’s FIM Capabilities

Tripwire File Integrity Monitoring (FIM) has the unique, built-in capability to reduce noise by providing multiple ways of determining low-risk change from high-risk change as part of assessing, prioritizing and reconciling detected change. Auto-promoting countless business-as-usual changes reduce the noise so IT has more time to investigate changes that may truly impact security and introduce risk. Tripwire uses agents to continuously capture detailed who, what, and when details in real time, to ensure that you detect all change, capture details about each one, and use those details to determine the security risk or non-compliance. Learn More About Tripwire File Integrity Manager today.