File integrity monitoring (FIM) is an

internal control Internal control, as defined by accounting and auditing, is a process for assuring of an organization's objectives in operational effectiveness and efficiency, reliable financial reporting, and compliance with laws, regulations and policies. A broad ...

process A process is a series or set of activities that interact to produce a result; it may occur once-only or be recurrent or periodic. Things called a process include: Business and management *Business process, activities that produce a specific se ...

that performs the act of validating the

integrity Integrity is the practice of being honest and showing a consistent and uncompromising adherence to strong moral and ethical principles and values. In ethics, integrity is regarded as the honesty and truthfulness or accuracy of one's actions. In ...

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems schedule tasks for efficient use of the system and may also i ...

and

application software Application may refer to: Mathematics and computing * Application software, computer software designed to help the user to perform specific tasks ** Application layer, an abstraction layer that specifies protocols and interface methods used in a ...

files using a verification method between the current file state and a known, good baseline. This comparison method often involves calculating a known cryptographic

checksum A checksum is a small-sized block of data derived from another block of digital data for the purpose of detecting errors that may have been introduced during its transmission or storage. By themselves, checksums are often used to verify data ...

of the file's original baseline and comparing with the calculated checksum of the current state of the file. Other file attributes can also be used to monitor integrity. Generally, the act of performing file integrity monitoring is automated using internal controls such as an application or

. Such monitoring can be performed

randomly In common usage, randomness is the apparent or actual lack of pattern or predictability in events. A random sequence of events, symbols or steps often has no :wikt:order, order and does not follow an intelligible pattern or combination. Ind ...

, at a defined

polling Poll, polled, or polling may refer to: Figurative head counts * Poll, a formal election ** Election verification exit poll, a survey taken to verify election counts ** Polling, voting to make decisions or determine opinions ** Polling places o ...

interval, or in

real-time Real-time or real time describes various operations in computing or other processes that must guarantee response times within a specified time (deadline), usually a relatively short time. A real-time process is generally one that happens in defined ...

Security objectives

Changes to configurations, files and file attributes across the IT infrastructure are common, but hidden within a large volume of daily changes can be the few that impact file or configuration integrity. These changes can also reduce security posture and in some cases may be leading indicators of a breach in progress. Values monitored for unexpected changes to files or configuration items include: * Credentials * Privileges and Security Settings * Content * Core attributes and size * Hash values * Configuration values

Compliance objectives

Multiple compliance objectives indicate file integrity monitoring as a

requirement In product development and process optimization, a requirement is a singular documented physical or functional need that a particular design, product or process aims to satisfy. It is commonly used in a formal sense in engineering design, includ ...

. Several examples of compliance objectives with the requirement for file integrity monitoring include: * PCI DSS - Payment Card Industry Data Security Standard (Requirement 11.5) * SOX - Sarbanes-Oxley Act (Section 404) * NERC CIP - NERC CIP Standard (CIP-010-2) * FISMA - Federal Information Security Management Act (NIST SP800-53 Rev3) * HIPAA - Health Insurance Portability and Accountability Act of 1996 (NIST Publication 800-66) * SANS Critical Security Controls (Control 3)

References

{{Reflist Change management Computer forensics

Security objectives

Compliance objectives

See Also

References