0

If we have a file that needs to change on a device that is monitoring with a tool like Qualys File Integrity monitoring. Either on Windows or using auditd on linux, how do we temporarily put some sort of "force field" around files or in some other way convince FIM that the changes were legitimate?

Patching and routine changes against tangentially related devices are spamming our queue with all sorts of invalid alerts. Patching occurs during maintenance windows and if FIM scanning took place during the maintenance windows it would be OK. Also, sometimes you don't want to squash alerts for an entire device just to prevent one known alert (this might be a bigger question, but I only mean it with respect to file integrity monitoring) - it's a bigger security risk and annoyance to stop alerts on a device than it is to intentionally generate alerts (think routine changes like editing /etc/hosts file or postfix relay db - these are not necessarily risky to the point that they need a freeze on ALL alerting for a device, just particular alerts).

So what I want to know is, how do security engineers usually allow changes to be made to filesystems occasionally, while not allowing arbitrary exceptions to be abused and still pick up illegitimate changes?

5
  • 1
    This appears to be a question that only Qualys can answer.
    – schroeder
    May 11 at 20:50
  • I'll make it clear I'm asking in a general sense. The idea of file integrity monitoring should have solved this. I certainly can thing of seventeen ways to do this if I rolled my own FIM solution. May 11 at 21:09
  • 2
    Scheduled exceptions during maintenance windows for patching.
    – schroeder
    May 11 at 21:45
  • @schroeder OK - that's where it gets qualys specific, qualys checks every four hours, we try to keep maintenance windows down to 2 hours. But if that's the best method oh well. May 11 at 21:49
  • 1
    This question is inherently FIM tool specific. Each product will have their own methods.
    – schroeder
    May 12 at 8:34

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.