How MDR (Managed Detection & Response) helps with File Integrity Monitoring (FIM)

A Managed Detection and Response (MDR) service provides file integrity monitoring (FIM) capabilities, which help alert you to and prevent breach and fraud attempts as well as accidental changes to key files. In this article, we overview some of the main reasons why you might want to consider an MDR service for file integrity monitoring.

What is file integrity monitoring?

File integrity monitoring (FIM) is a process of checking to see if critical files or operating systems have been altered or corrupted when they shouldn’t have been.

When that happens, it can result in a weakened security posture and in some cases may indicate that a breach is in progress.

Why is file integrity monitoring important?

File integrity monitoring is important in a number of ways.

Breach detection: Prompt recognition of changes to significant files or software can be a key alert that the environment may be under attack. This enables security to be checked and systems closed down if necessary.

Fraud alert: FIM can also alert organisations if unauthorised attempts are made to change data from people within the environment.

Identifying and reversing unintended changes: File changes can be made inadvertently by legitimate staff members. These can have significant unintended consequences and FIM makes it much easier to roll back the change or take appropriate action to mitigate it.

PCI DSS Compliance: FIM is required or recommended by many regulatory standards, including PCI DSS, which requires integrity monitoring for awareness of suspicious changes to critical data and system files, along with file comparisons on at least a weekly basis.

Forensics and recovery: If the worst does go wrong, file integrity monitoring makes it much easier to understand what happened, how it happened and therefore how it can be prevented in the future. It also simplifies the process of returning systems to their correct state.

How does file integrity monitoring work?

File integrity monitoring works by comparing the current file with a baseline and then triggers an alert if the file has been changed or updated in a way that conflicts with the company’s security policies.

This alone identifies if critically protected files have been changed by a human, or more importantly unexpectedly by malware.

Typically FIM is deployed to critical files that should never change within your operating system, for example, or at least files that have authorised and expected infrequent changes.

Anything outside of these changes can be classed as unusual and require immediate investigation.

How does an MDR service help with file integrity monitoring?

A good MDR service like the one offered as a managed service by Securious offers a fully-featured and integrated file integrity monitoring service.

Should any abnormal activity be detected, the MDR system will alert the team allowing further investigation to be made.

In addition, full logs of all changes are kept for a minimum of 6 months, meaning forensics and analysis is made quick and easy when required.

The Securious MDR meets all the appropriate requirements of PCI DSS compliance.

Want to learn more?

If you’d like to learn more about how an MDR solution could provide your organisation with file integrity monitoring, please call us on 01392 247 110, email info@securious.co.uk or fill in the contact form below.