FIM: File Integrity Monitoring

File Integrity Monitoring (FIM) refers to the processes and implementations designed to protect data from unauthorized changes, such as cyberattacks.

File integrity means maintaining and ensuring the accuracy and consistency of data throughout its lifecycle, allowing detection of whether it has been altered intentionally or accidentally. Alterations may result from syntax changes, unauthorized content modifications, physical storage damage, programming errors, data overwriting, transmission errors, among other factors.

FIM is a control mechanism that examines files and verifies whether their integrity remains intact. It alerts security processes if files have undergone changes. This type of tool considers any change a suspicious integrity issue unless explicitly defined as an exception.

As networks and configurations become increasingly complex over time, file integrity monitoring becomes essential. Monitoring file changes is one of the preferred tools for detecting breaches and malware, and it is also a strict compliance requirement for many regulations.

In this context, an attacker’s first action after gaining system access is typically to modify critical files to avoid detection. By using file integrity monitoring, intruders can be detected at the moment they attempt to alter files or configurations.

Additionally, FIM tools allow visibility into exactly what changed and when. This enables instant detection of a data breach before a full-scale damaging attack occurs.

How It Works

In dynamic environments, files and configurations change continuously and rapidly. Therefore, the most important characteristic of file integrity monitoring is distinguishing authorized from unauthorized changes, even in large and highly concurrent systems.

FIM operates using checksum and hash-based methods.

Checksum Method

This method requires a trusted baseline element and a comparison element. Each file is compared with its baseline; if the results match, integrity is confirmed. If not, the data has been modified or corrupted, which should trigger corrective actions such as retransmission, restoration from a backup copy, or deletion.

Hash-Based Verification

Hash-based verification compares the current file hash value with a previously calculated value. If both match, file integrity remains intact.

A hash function is a mathematical algorithm that takes an unlimited set of input data and produces a finite set of characters that uniquely identifies that input. Importantly, it is computationally impossible to reconstruct the original input from its hash.

Main Components of FIM

Generally, FIM includes three main components:

• Database: Stores information about the original state of files and configurations in the form of cryptographic hashes.
• Agents: Technical components that scan monitored devices’ files and send information to the database for comparison.
• User Interface: Provides administrative interaction, offering centralized reporting, evaluation, monitoring, and change control.

File Attributes Examined by FIM

A FIM tool examines:

• Created, modified, and accessed configurations and permissions
• Security settings and privileges
• File content
• Core attributes and file size
• Hash values based on file content
• Configuration values
• Credentials

File Integrity Monitoring can be continuous, real-time, periodic, random, or scheduled according to rules established by the security team.

A robust FIM solution should monitor all technological components of an organization, including:

• Network devices and servers
• Workstations and remote devices
• Databases, directories, and operating systems
• Cloud-based services

At minimum, an enterprise solution must provide change management, real-time logging, centralized reporting, and alerting.

Often, FIM is part of a broader auditing and security solution that may include automatic rollback capabilities to restore files to a trusted previous state.

Importance

File Integrity Monitoring scans, analyzes, and reports unexpected changes in critical files within a technological environment. By doing so, it adds a layer of data and application security while accelerating incident response.

Its fundamental importance lies in:

Detecting Malicious Activity

If an attacker infiltrates an organization’s environment, it is critical to know whether they attempted to alter files essential to operating systems or applications. FIM enables monitoring and protecting file, application, OS, and data security.

Identifying Undesired Changes

Administrators or users may unintentionally modify files. These changes can range from minor oversights to security backdoors or unsafe operations. FIM simplifies forensic investigations by focusing on relevant changes that need to be reversed or corrected.

Patch and System Status Verification

FIM verifies whether files are patched to the latest version by scanning installed versions across multiple devices and locations using post-patch checksums.

Regulatory Compliance

The ability to audit changes and monitor specific activities is required by many security regulations and best practices.

Identifying Undesired Changes

Administrators or users may unintentionally modify files. These changes can range from minor oversights to security backdoors or unsafe operations. FIM simplifies forensic investigations by focusing on relevant changes that need to be reversed or corrected.

Patch and System Status Verification

FIM verifies whether files are patched to the latest version by scanning installed versions across multiple devices and locations using post-patch checksums.

Regulatory Compliance

The ability to audit changes and monitor specific activities is required by many security regulations and best practices.

Benefits

• Protects confidential data and files from unauthorized access and modification
• Provides visibility into what file changed, when it changed, and who changed it
• Tracks file and directory access, movement, and sharing
• Detects zero-day malware that alters key system files or installs malicious processes
• Identifies insider misuse and protects sensitive data from improper usage
• Provides insight into Advanced Persistent Threats (APT), which are often difficult to detect

FIM Integration with SIEM

Information obtained through file integrity monitoring is most effective when integrated into a broader event flow derived from log data collected across the organization’s infrastructure (workstations, servers, domain controllers, file servers, antivirus, IDS/IPS systems, etc.). Correlating these data sources provides situational awareness across diverse events.

Security Information and Event Management (SIEM) systems already collect log data for correlation and analysis purposes.

Combining FIM events with SIEM creates a more robust security system that offers intelligent defense-in-depth against advanced and sophisticated cyber threats.

User-Based File Integrity Monitoring

Correlation between Active Directory and file audit events identifies which user accessed or modified a file and tracks their activity before and after the change.

Data Loss Prevention

Correlating file audit events with SIEM logs enhances advanced threat intelligence and enables automated response actions such as system shutdowns, USB disabling, network isolation, or user account suspension.

Zero-Day Threat Detection

By correlating antivirus and IDS/IPS logs with file audit events, SIEM can detect zero-day malware and stop it before it damages secure files. SIEM response actions can terminate malicious processes or quarantine systems.

Continuous Compliance Support

While FIM is mandatory for many compliance regulations, SIEM systems provide ready-to-use compliance templates. Including FIM results in compliance reports demonstrates comprehensive network security to auditors.

Another benefit of combining FIM with SIEM is noise reduction. Customized alerts based on predefined correlation rules eliminate the need to manually analyze vast volumes of file audit events.

Protelion’s Threat Detection and Response solution uses FIM to detect file changes and also analyzes behavioral patterns.

Learn more about the solution’s components and functionalities here.