McAfee Integrity Monitor

McAfee Integrity Monitor Overview:

File integrity monitoring (FIM) is the capability to monitor files and directories on a server for changes to content, permissions, or both. McAfee Integrity Monitor provides the continuous FIM that is essential for testing and verifying the security of an environment, or meeting critical compliance requirements, such as those outlined in the Payment Card Industry Data Security Standard (PCI DSS).

Description:

McAfee Integrity Monitor helps identify authorized changes versus unauthorized changes and possible malicious activities, ensuring operational integrity has not been compromised. A strong compliance posture requires knowing the current state of your system — its trusted state — and tracking changes that cause the system to alter from this point. File integrity monitoring (FIM) examines files and directories on a server, identifying changes to content and permissions.

Integrity Monitor detects changes across distributed systems and data center infrastructures, including databases, network devices, and specialized servers, such as AS/400 and IBM 4690. For enterprises with heterogeneous environments, this extended alerting augments the FIM benefits of McAfee Change Control for servers, giving IT managers unprecedented visibility of their entire infrastructure.

FIM is also a critical part of meeting the following PCI DSS requirements:

• PCI 10.5.5 — Use FIM and change detection software to ensure existing log data cannot be changed without generating alerts.
• PCI Control 11.5 — Deploy FIM software to alert personnel to unauthorized modification of critical system or content files.

Benefits and Features:

Solutions:

File integrity monitoring (FIM) is the capability to monitor files and directories on a server for changes to content, permissions, or both. McAfee® Integrity Monitor provides continuous FIM that is essential for testing and verifying the security of an environment, or meeting critical compliance requirements such as those outlined in the Payment Card Industry Data Security Standard (PCI DSS). McAfee Integrity Monitor provides comprehensive information about every change, including the user and program used to make the change.

When it comes to your IT infrastructure, strong compliance requires two key components: a trusted system state and the ability to verify and provide authorized changes that will not compromise corporate standards or compliance. The PCI DSS in particular highlights the need for safe change actions through PCI section 10.5.5 (“Use file integrity monitoring and change detection software on logs to ensure that existing log data cannot be changed without generating alerts”) and PCI section 11.5 (“Deploy file integrity monitoring software to alert personnel to unauthorized modification of critical system or content files”).

Advantages of McAfee Integrity Monitor

• Comprehensive change detection—McAfee Integrity Monitor captures every single change to the file. Detecting all changes is important for sustaining compliance because it allows you to see where your compliance policies are being challenged and addresses inappropriate change at the source.
• Rich forensic data capture—McAfee Integrity Monitor captures details about every change, including the exact time of the change; who was logged into the machine at that time; what processes (such as editors) were running; whether the change was manual or made by an authorized program; and, if manual, which user made it. This information is critical for distinguishing between a safe change made to a trusted site and a violation. It also enables rapid investigation of change-related problems.
• No operational trade-offs—McAfee Integrity Monitor operates with very low overhead so the entire infrastructure can be monitored without impact.

Centralized deployment and management through ePO
Seamless integration with McAfee ePolicy Orchestrator® (ePOTM) software eases McAfee Integrity Monitor agent deployment, management and reporting. The single McAfee ePO console lowers the cost of ownership by consolidating security and compliance management. This saves IT organizations training and operational costs, while providing unified control over the policies and protections on each enabled system. Integration with ePO eliminates the need to manage data in two separate systems.

Monitoring the Secure Environment
McAfee Integrity Monitor provides compliance and change alerts not only to servers, but also covers additional component coverage such as databases and network devices, offering a single view for change reporting and change alerts throughout the entire enterprise environment. Alternative components like virtual servers, IBM 4690 systems and AS400 servers not traditionally covered by other providers round out the broad set of platforms covered by Integrity Monitor.

• Database monitoring—Monitors three key areas:
  • Activities (logons, logoffs, user/role creations, password changes, and more)
  • Schema changes (CREATE/ALTER tables, indices, stored procedures, and more)
  • Data changes (INSERT/UPDATE/DELETE of sensitive records)
• Network configuration monitoring—Provides alerts to configuration changes to some of the most commonly used networking components in the industry
• AS400—Offers continuous integrity monitoring for this well-respected enterprise platform, extending the existing value and ensuring compliance for this strong infrastructure
• IBM4690—Prevalent retail platform for point-of-sale (POS) systems now have a solution for file integrity monitoring, giving retailers more options for PCI compliance

System Requirements:

Supported Operating Systems (OS)

• Windows NT
• Windows 2000/2003/2008
• Windows 7
• Windows XP/Vista
• Windows XPE
• Windows XP/Vista (64-bit)
• Windows 2003/2008 (64-bit)
• Red Hat EnterpriseLinux 3/4/5
• CentOS 4/5
• SUSE Enterprise Linux 9/10
• Oracle Enterprise Linux 5
• Solaris 8/9/10
• HP-UX 11.00/11.11/11.23
• AIX 5.2/5.3
• IBM i5/OS (AS400) V5R3/V5R4/V6R1
• IBM 4690 OS V5

Supported Databases

• Oracle 8i/9i/10g
• SQL Server 7/2000/2005
• DB2 8.x/9.x
• DB2 for iSeries V5R4

Supported VMware Hypervisors

• ESX 3.0.x/3i/3.5
• Virtual Center
• VMware Server 2.0

Network Devices
 

Documentation:

Download the McAfee Integrity Monitor Solution Datasheet (PDF).