Title

System files must be monitored for unauthorized changes. (Cat II impact)

Discussion

Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

Check Content

Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a finding. A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix Text

Monitor system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. This can be done with the use of various monitoring tools.

Additional Identifiers

Rule ID:

Vulnerability ID: V-2907

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.