LOG-13 File Integrity Monitoring (FIM)

What is LOG-13 File Integrity Monitoring (FIM) Control?

File Integrity Monitoring (FIM) is a type of change auditing that verifies and validates files by comparing the latest versions of them to a known, trusted “baseline”. If any changes are detected( altered, updated, or compromised), the FIM generates alerts to prompt investigation and remediation. An FIM is both reactive (forensic) and proactive.

File Integrity Monitoring (FIM) is usually part of the change management section of any compliance standard and is not mandatory unless the organization is susceptible to Segregation of Duties (SOD) issues. An example of SOD is the ability for certain developers to write code and deploy it into production. Ideally, these two functions should be separate and handled by two separate individuals. However, it is common to observe these dual roles in small organizations. As such, an FIM tool or other alerting mechanism that would notify personnel of any changes being deployed is necessary.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t personally used them.

Tools

SolarWind Security Event Manager

ManageEngine ADAudit Plus

DataDog Security Monitoring

OSSEC

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• N/A: No template recommendation

Control implementation

To implement this control,

Implement a FIM tool and ensure that the following are taken into account:

1. Restrict access to a select few.
2. Define the alert rules to be notified of any changes that get deployed.
3. Implement an alerting mechanism.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Screenshot of the FIM configuration
2. Alert notification of the FIM

Evidence example

For the suggested action, an example is provided below:

1. Screenshot of the FIM configuration.
   The following screenshot shows the FIM configuration.
   
2. Alert notification of the FIM.
   The following screenshot shows the FIM configuration.