File integrity monitoring (FIM) refers to an IT security process and technology that tests and checks operating system (OS), database, and application software files to determine whether or not they have been tampered with or corrupted. FIM, which is a type of change auditing, verifies and validates these files by comparing the latest versions of them to a known, trusted “baseline.” If FIM detects that files have been altered, updated, or compromised, FIM can generate alerts to ensure further investigation, and if necessary, remediation, takes place. File integrity monitoring encompasses both reactive (forensic) auditing as well as proactive, rules-based active monitoring. 

Why File Integrity Monitoring is Important

FIM software will scan, analyze, and report on unexpected changes to important files in an IT environment. In so doing, file integrity monitoring provides a critical layer of file, data, and application security, while also aiding in the acceleration of incident response.   

• Detecting Illicit Activity

If a cyber attacker intrudes upon your IT environment, you will need to know if they have tried to alter any files that are critical to your operating systems or applications. Even if log files and other detection systems are avoided or altered, FIM can still detect changes to important parts of your IT ecosystem. With FIM in place, you can monitor and protect the security of your files, applications, operating systems, and data.

• Pinpointing Unintended Changes

Often, file changes are made inadvertently by an admin or another employee. Sometimes the ramifications of these changes may be small and go overlooked. Other times, they can create security backdoors, or result in dysfunction with business operations or continuity. File integrity monitoring simplifies forensics by helping you zero in on the errant change, so you can roll it back or take other remediation.

• Verifying Update Status and Monitoring System Health

You can check if files have been patched to the latest version by scanning installed versions across multiple locations and machines with the post-patch checksum.

• Meeting Compliance Mandates

The ability to audit changes, and to monitor and report certain types of activity is required for compliance with regulatory mandates such as GLBA, SOX, HIPAA and PCI DSS.

File integrity monitoring examines various aspects of a file to create a “digital fingerprint.” It then compares this fingerprint to a known, good baseline fingerprint. While native auditing tools exist, these generally all suffer from shortcomings, such as decentralized storage of the security logs from multiple domain controllers, lack of information within the log entry regarding the old settings, and inability to recover the object/configuration from the audit log, to name few. For these reasons, organizations with moderately to highly complex IT environments generally rely on proven enterprise solutions.

• Created, modified, and accessed settings and permissions
• Security and privilege settings
• Content of the file
• Core attributes and size
• Hash values, based on file contents
• Configuration values
• Credentials
• FIM can be carried out on a continual, snapshot, or regular basis. It can happen randomly, or to any other rules that the security team sets up.

• Network devices and servers
• Workstations and remote devices
• Databases, directories, OS, and middleware
• Cloud-based services
• Hypervisor configuration, and Active Directory
• At minimum, an enterprise solution should provide change management, real-time logging, centralized logging and reporting, and alerts. Often, file integrity monitoring is part of a broader auditing and security solution that will also include capabilities such as automated rollback of changes to an earlier, trusted state. An ideal solution will give you clear, rapid information on the who, what, where, and when for every access and change event.