Docy Child

LOG-13 File Integrity Monitoring (FIM)

Estimated reading: 2 minutes 99 views

What is this control really about?

FIM is a type of change auditing that verifies and validates files by comparing the latest versions of them to a known, trusted “baseline.” If any changes are detected( altered, updated, or compromised), the FIM generates alerts to prompt investigation and remediation. A FIM is  both reactive (forensic) and proactive.

FIM is usually part of the change management section of any compliance standard and is not mandatory unless the organization is susceptible to Segregation Of Duties (SOD) issues. SOD example is the ability for certain developers to write code and to deploy them into production. Ideally, these two functions should be separate and handled by two separate individuals. However, it is current to observe these dual roles in small organizations. As such, an FIM tool or other alerting mechanism that would notify personnel of any changes being deployed is necessary.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. Kintent does not personally recommend any of the tools below, because we haven’t personally used them. 

Tools
SolarWind Security Event Manager
ManageEngine ADAudit Plus
DataDog Security Monitoring
OSSEC

Available templates

  • N/A for this section

What is required to implement this control?

Implement a FIM tool and ensure that the following are taking into account:

  • Restrict access to a select few
  • Define the alert rules to be notified for any changes that gets deployed
  • Implement an alerting mechanism

What evidence is the auditor looking for?

  1. Screenshot of the FIM configuration
  2. Alert notification of the FIM

An example of what an artifact can look like

1- Screenshot of the FIM configuration

log 13 1

2- Alert notification of the FIM

log 13 2

Log 13 3

Leave a Comment

ON THIS PAGE
SHARE THIS ARTICLE