Importance of File Integrity Monitoring
While some security professionals may argue that file system monitoring is important, few of them will argue the importance of your web root. It is not uncommon for a threat actor to gain access to a remote box and modify files or, upload files in order to preserve access (web shells, netcat, etc.).
Failing to maintain monitoring on public accessible files can in many times force administrators to over-look an attack. With active file system monitoring you can maintain an audit trail of files created, modified and, deleted. This will help piece a larger puzzle together in order to assist with a breach or incident event.
Our tools work within the bounds of the security measures your organization are seeking to establish. Whether that be passive monitoring (alerting only) or, active monitoring (taking control of the breach and also alerting administrators.)
In cases with active monitoring our tools will be able to stop attacks before they become a problem and allow a threat actor to further infiltrate your web location, server or VPS. With the tools set in active mode, we also have the availability of obtaining copies of the tools the attacker is utilizing in order to have a better understanding of the persistence they are establishing.
With active file system monitoring, and additional tools such as our Log Analyzer Network Defense Solutions is able to isolate the attack(s) when they happen and begin an investigation around the IP address or, system that has accessed the box within the time-frame when the alert has triggered.
Dangers of Web Shells
With a recent report (as far back as April 23 2020) https://www.helpnetsecurity.com/2020/04/23/web-shell-malware/ real world examples have shown that the detection of web shells is falling behind the threat element. Few methods are discussed regarding web shells, and file monitoring is one of the few ways in which a server may stand a chance at detection. However, the cost of such solutions can be quite expensive! Network Defense Solutions has brought the costs down for monitoring, reporting, containment and mitigation!
If you would like more information about our tools, detection and security services for web applications please feel free to get in contact with us today!
{loadformmaker 16}
