File integrity monitoring

- [Presenter] File integrity monitoring…is an important component of a defense…in depth approach to information security.…We use many different defenses designed…to keep end point systems safe.…Anti-virus software is designed to detect malicious files…before they gain a foothold on end points.…Centralized, multi-factor authentication…prevents attempts to compromise user accounts.…Host intrusion detection and prevention systems…alert us to potential compromises and block them.…

However, the principle of defense in depth suggests…that we should have controls in place…that can help us detect an intrusion…even when those other systems might fail.…File integrity monitoring is a great example…of this type of control.…File integrity monitoring systems watch the file system…of an endpoint or server for any unexpected changes,…and then report those changes…to an administrator for further investigation.…They perform this function by using…cryptographic hash functions.…

Hash functions take an input of any size…and transform it into a unique, cryptographic hash value.…