4

I have hundreds of windows servers in my environment that I need to monitor using FIM.

I am afraid that after every patch (each patch might affect and change the hash of hundreds of sensitive files) I will get tens of thousands of false positive alerts that I will need to verify and investigate one by one.

Do you know of an effective way to manage this issue?

Improve this question
0
4

If you are checking for changed files, then yes, every file changed will alert. This is exactly how this should work.

Usual mitigation techniques include:

  • limiting the number of files you check. Usually based on criticality or materiality
  • forcing your FIM tool to calculate new checksums as part of your change process

Both present risks of missing unwanted changes.

Improve this answer
2
  • Expanding on your second point, a typical process is to apply the patches to a dev server first, identify the new/changed files, compute the new hashes, add them to the current list of valid hashes and sign the new list, then deploy that signed list prior to the installation of the patches in production. If someone misses a changed file so no new hash is generated for it, when you apply the patches the FIM tool will throw a lot of alerts. That's undesirable. – John Deters Jan 6 '17 at 14:31
  • Absolutely! Process is everything here! – Rory Alsop♦ Jan 6 '17 at 15:08
3

There are several ways to approach this depending on which "big name" FIM solution you have deployed. Each configuration creates a different set of risks.

  1. Approve Files Based on Publisher - Not advised. The publisher field cannot be trusted unless there is a corresponding signature.
  2. Approve Based on Signature - This is more secure, however, not all files are signed. Even more so, a file that was signed previously may not be signed after being updated.
  3. Approve Based on Hash - You are aware of the pros/cons with hashes
  4. Approve Based on Dir Path - Not advised. A trusted path allows all files in a specified dir to be modified and trusted. You can go a step further and state that all files in a dir may only be modified/created by a specific process.
  5. Trusted Window - This essentially allows file changes to occur during a trusted window. One will want to review all changes before placing enforcement back to normal. Quite the daunting task.
  6. Trusted Deployer - This is most likely your best alternative. If you use a client to deploy patches to machines (eg: BigFix, SCCM, etc) you can mark this client as a "trusted installer" which allows it to apply patches.

The specific FIM solution you have deployed may or may not have all these feature sets.

Improve this answer
1
  • The benefit of Trusted Deployer is that what the Trusted Deployer installs is considered a non malicious change and the FIM tool does not report it. – Eloy Roldán Paredes Feb 24 '16 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.