File Integrity Monitoring (FIM): What, Why, and How
How file integrity monitoring detects unauthorized changes to critical files and why it's required by HIPAA, PCI-DSS, and NIST.
File Integrity Monitoring (FIM) watches critical system files, configuration files, and sensitive data files for unauthorized changes. When a file is modified, deleted, or has its permissions changed, FIM alerts your security team. It's required by HIPAA, PCI-DSS, and NIST — and it's one of the most effective ways to detect both malware and insider threats.
What to Monitor
System Files: Operating system binaries, DLLs, and configuration files (Windows: System32, etc.; Linux: /etc, /bin, /sbin). Changes here could indicate rootkit installation or system compromise.
Application Config: Web server configs, database configs, application settings. Unauthorized changes could indicate an attacker establishing persistence or modifying security settings.
Security Tool Config: EDR policies, firewall rules, group policy objects. Attackers often disable or modify security tools as part of their attack chain.
Sensitive Data: Files containing PII, PHI, financial data, or credentials. Changes or access to these files outside normal patterns warrant investigation.
How FIM Works
FIM takes a baseline snapshot of monitored files — recording hash, permissions, ownership, timestamps, and size. It then continuously (or periodically) compares current state to the baseline. Any deviation triggers an alert.
Modern FIM goes beyond simple hash comparison. It can identify WHO made the change (which user or process), HOW the change was made (which tool or command), and correlate the change with other security events (was this change preceded by a suspicious login?).
Reducing Noise
The biggest challenge with FIM is noise. System updates, legitimate config changes, and routine operations generate a flood of expected changes. The key is tuning: define expected change windows (patch maintenance windows), whitelist known-good change sources (your patch management system, your config management tool), and focus alerting on unexpected changes outside maintenance windows.
When FIM is integrated with your SIEM, it becomes dramatically more powerful. A file change that correlates with a suspicious login, a new process execution, and a network connection to an unknown IP is much more significant than a file change in isolation.