orrelog File Integrity Monitor (FIM) User Reference Manual

Transcription

1 orrelog File Integrity Monitor (FIM) User Reference Manual

2 Section 1: Introduction This document contains installation and application notes regarding the CorreLog File Integrity Monitor (CorreLog FIM) which is a compact set of software tools that instrument a Windows Vista, XP, or 200X operating system to continuously check the integrity of selected files. This permits the CorreLog Security Correlation Server to effectively check whether files have changed anywhere on a managed Windows platform. The File Integrity Monitor executes as a separate process on each Windows 32- bit and / or 64-bit platform. Periodically (by default each hour) this process scans all the files on the system as specified by its configuration file. If any file has been added, deleted, or modified, the file name is recorded and a Syslog message is sent to the main CorreLog Server. At the CorreLog Server, the operator can create (or recreate) a file image, can inspect the list of changed files, and can set FIM parameters. The CorreLog FIM is very lightweight and easy to install. The program should be installed on each Windows platform of interest in an organization or enterprise. If you are unfamiliar with Syslog protocol as a management technique, refer to the CorreLog User Reference manual, which contains a comprehensive description of Syslog functionality. If you wish to get started immediately with the installation of the CorreLog FIM, see notes at the bottom of this current section. CorreLog FIM, Page - 5

3 CorreLog Windows Tool Set (FIM) Overview The CorreLog File Integrity Monitor (FIM) is a collection of executables and files that provide extra security at a managed Windows server. The File Integrity Monitor is installed in a fashion similar to the CorreLog Windows Agent and WTS, and operates as a standard Windows service. Periodically, the system scans all the files specified by a configuration file, and sends Syslog messages to the CorreLog Server when files are added, deleted, or modified on the system. At the CorreLog Server, the user can configure the schedule of execution for the process, can generate an Image File (containing a baseline listing of files), and can run on-demand checks of the file system. Additionally, the operator can inspect the list of managed files, and any changes detected during the last scan of files. The CorreLog FIM consists of the following parts. CorreLog File Monitor Agent. (FMON Agent.) This is a compact but powerful Windows service that is installed on each managed platform. The service periodically scans the file system to detect new, modified, or deleted files, and sends Syslog messages to the CorreLog Server when file changes are detected. The service executes on XP, Vista, and 200X servers. Both 32-bit and 64-bit versions of the program are available. CorreLog Server Web Interface. This screen is added to the CorreLog Server, and is accessed via the "Device Information" screen (by clicking on the hyperlink of an IP address anywhere within CorreLog.) The screen permits the user to view the list of managed files, and the status of the File Integrity Monitor's execution. CorreLog Remote Configuration Utility. This is a stand-alone program that permits the user to download and upload the configuration file of the CorreLog FIM service, so that batch configuration of these programs can be remotely performed. The above programs are documented in this manual, including installation and configuration, along with extra application notes that describe how to perform advanced configuration of the system. Program Features The CorreLog FIM is designed to support the enterprise requirements for security, with special regard to PCI/DSS (as well as other) security guidelines. The program is easy to install and use, and contains the following specific features and functions. CorreLog FIM, Page - 6

4 Fast File Scans. The File Integrity Monitor is designed to monitor large numbers of files quickly and non-intrusively. The program will typically scan 10,000 files within one or two minutes, permitting hourly checks of file integrity. Ability To Monitor Files By Directory. The File Integrity Monitor is easy to configure, and allows the user to specify files by directory, including the ability to match and exclude files by directory name, file suffix, file prefix, or other keywords. This allows an operator to precisely target special files on the managed system. Ability To Perform File Checksums. The File Integrity Monitor checks the file creation time, modify time, and file size to determine whether a file has been modified on the system. As an additional feature, the user can enable the calculation of checksums on each file to check whether any single bit in the file has been changed. Ability To Tune CPU Usage. The File Integrity Monitor allows the user to throttle the amount of CPU used by the process, as well as schedule the execution hourly, or daily. This permits the system to operate nonintrusively. Remote Configuration Capabilities. The File Integrity Monitor allows the user to remotely access and adjust (with authentication) the program configuration data, permitting the user to make changes to the file integrity monitor while it is running. Additionally, the user can obtain real-time status from the File Integrity Monitor, to view the remote status and state of the program. Support for 64 Bit Platforms. The File Integrity Monitor supports both 32-bit and 64-bit platform architectures. On 64-bit systems, the File Integrity Monitor can access system pathnames that are not accessible to 32-bit programs. The CorreLog FIM, Fast Start The remainder of this manual will deal with the various detailed aspects of the CorreLog File Integrity Monitor software in detail. For those users wishing a quick start, the following information will get the CorreLog FIM software up and running as quickly as possible on a Windows platform, permitting you to immediately begin using the program. The CorreLog FIM Software is obtained as a single self-extracting WinZip file from CorreLog, with the name "co-n-n-n-fmon.exe." This package is first installed at the CorreLog Server site. This package adds the FMON CorreLog FIM, Page - 7

5 Agent packages to the server, adds support screens, and modifies the "Home" page of the system to permit downloads of the agent packages. Note: The co-n-n-n -fmon.exe program is installed ONLY at the CorreLog Server. It is not installed on the actual managed platform where File Integrity Monitoring is to take place. Once the co-n-n-n-fmon.exe program is installed, you can access the package for the managed platform via the "Home" screen of the CorreLog Server. After installing the package at the CorreLog Server, the operator installs the FMON Agents in a manner similar to the CorreLog Windows Agents: The operator goes to each manage platform, connects to the CorreLog Server via the Web Browser, and downloads the appropriate package from the CorreLog Server "Home" page. At the managed platform, after downloading the appropriate FIM package, the operator executes the self-extracting WinZip file, and extracts files to the desired location, by default the C:\CorreLog directory of the platform. Note: The software package that is installed on the target platform is given a name such as "fi-n-n-n.exe" and "fi-n-n-n-x64.exe", depending upon the particular architecture of the platform CPU (either 32 bit or 64 bit.) The proper version of the software, agreeing with the platform architecture, should be installed. When the files are extracted, the FMON Agent installation dialog automatically starts. The user needs to provide only one argument to the installation dialog, which is the destination hostname or IP address of the Syslog server running on the network. (This will generally be the hostname or IP address of the platform running the CorreLog Server software.) When the dialog finishes, the CorreLog FMON Agent is installed and started. The user can check the Syslog file of the destination host to verify that a Syslog message was correctly sent and received. The platform does not need to be rebooted. The user can optionally configure each FMON Agent at the CorreLog Server by clicking on the IP address hyperlink of the device anywhere within CorreLog, and then clicking "File Integrity Monitor". (See Section 4.) The entire installation steps, outlined above, will usually take about one minute or so to complete for each managed platform. An Administrator type login is required. If the installation fails (for example if the installer mistypes the destination hostname or IP address) the installation procedure can be run again without running the uninstall program. CorreLog FIM, Page - 8

6 Fast Start, Workflow Overview Once the CorreLog FMON Agent is installed, a simple workflow is used to maintain the integrity of files. At periodic intervals, messages are generated on the system indicating the status of files on a managed system. The operator sees these indications by looking for the summary status of file scans and / or individual messages indicating that files have been added, deleted, or changed. This may include generation of tickets and notifications when files are changed. When a file change indication is received, the user clicks down on the IP address of the remote device (appearing anywhere in CorreLog) and then clicks on the "File Integrity Monitor" hyperlink on the "Device Information" screen. This displays the "File Integrity Monitor" screen (discussed in Section 5 of this manual.) On the "File Integrity Monitor" screen, the user inspects the list of change by clicking on the "View File Change List" hyperlink at the upper left of the screen. The operator resolves any differences in the file system by removing or installing files on the manage system. The operator creates a new Image File by clicking on the "Config" button of the File Integrity Monitor screen, and then clicking "Create New Image File". This causes a new image file to be generated that includes any changes accepted by the operator. The above process is the typical workflow of the operator, used to resolve changes to files on the managed platform. Other workflows (such as automatically generating new Image Files for the target platform) are also available, and will depend upon the requirements of the organization. Future sections will describe in detail the various other features, adaptations, customizations, and applications associated with the CorreLog FIM system. The reader is encouraged to experiment with the system. In particular, almost all of the information required to understand the essentials of the CorreLog FIM system has now been explained. You can begin monitoring your system file integrity information right now! CorreLog FIM, Page - 9