FILE INTEGRITY MONITORING

The File Integrity Monitoring module (FIM) constantly checks the integrity of the system it is monitoring. FIM is able to detect tampering of files and directories by alerting immediately to a violation by intruders allowing immediate remedial action to be taken.
‍
FIM is the module which allows to obtain the PCI-DSS certification. PCI-DSS affects any entity that processes a very specific piece of information: the payment card number (technically known as PAN) issued by Visa, Mastercard, American Express, JCB, or Discovery brands. So, it affects all commercial activities (shops, hotels, e-commerce operators), banks, service providers (hosting providers the keepers, in the database, of credit card data).
‍
FIM can be activated on all Oplon suite for organizations needing to obtain PCI-DSS certification or organizations which have a modern security system. FIM can also be installed and activated on platforms different from Oplon to constantly check the integrity of files and directories such as Apache, JBoss, Tomcat, MySQL, OS Linux installations. However, the system is parameterizable and can be configured for any service.
‍
Oplon File Integrity Monitoring integrates with all SIEM and alarm centralized management systems of datacenters and organizations

Which are the benefits?

1. In the case of server intrusion, it allows us to verify whether the areas under observation have been compromised by avoiding rebuilds from scratch of platforms that are suspected to have been altered. This avoids rebuilding entire datacenters by assumed breach and compromise of servers
2. It is a compulsory tool to achieve PCI-DSS certification
   
3. It allows to immediately signal changes or cancellations of files and directories
4. The system already has embedded some preconfigured configurations for the most common Operating Systems and Application Environments e.g.: Apache, JBoss, Tomcat, MySQL, OS Linux...
5. Possibility to configure new environments or customize already available template environments
   
6. Logging of alerts is performed on the centralized database. Any SIEM can read the database and assign alerts to be highlighted to the SOCs that manage it
7. Possibility of temporary exclusion of verifications. This makes it possible not to report false positives during application updates. After the application is updated, Oplon FIM re-executes the checks, which are subject to scheduled maintenance, without reporting them, avoiding the generation of false positives