Monitoring Data - 4.5
Summary
File Integrity Monitoring (FIM) detects unauthorized changes to critical files, while Data Loss Prevention (DLP) safeguards sensitive data across its usage, transit, and storage.
Notes:
File Integrity Monitoring (FIM)- Monitoring core OS files and configurations for unauthorized changes, which could indicate malicious activity.
- Host-based IPS (HIPS) or IDS (HIDS) can be used to detect and prevent unauthorized file changes.
Data Loss Prevention (DLP)
- Monitoring for confidential or sensitive data that could be "lost" or leaked. DLP solutions exist for both on-premise and cloud-based systems and aim to prevent unauthorized data exfiltration.
- Data in Use: Active use of data on a device or endpoint (e.g., computer).
- Data in Transit: Data moving across a network or internet.
- Data at Rest: Data stored on a server, database, or cloud storage.