Monitoring Data - 4.5

Summary

File Integrity Monitoring (FIM) detects unauthorized changes to critical files, while Data Loss Prevention (DLP) safeguards sensitive data across its usage, transit, and storage.


Notes:

File Integrity Monitoring (FIM)
  • Monitoring core OS files and configurations for unauthorized changes, which could indicate malicious activity.
  • Host-based IPS (HIPS) or IDS (HIDS) can be used to detect and prevent unauthorized file changes.

Data Loss Prevention (DLP)

  • Monitoring for confidential or sensitive data that could be "lost" or leaked. DLP solutions exist for both on-premise and cloud-based systems and aim to prevent unauthorized data exfiltration.
    • Data in Use: Active use of data on a device or endpoint (e.g., computer).
    • Data in Transit: Data moving across a network or internet.
    • Data at Rest: Data stored on a server, database, or cloud storage.