IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.93 Regular integrity checking
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Regular checking of the file system for unexpected changes helps to detect
inconsistencies. In this way it is also possible to detect attacks quickly. If an
attack has indeed been made, it is important to reconstruct the attacker’s
approach. On the one hand this serves the purpose of ensuring that users do
not have recourse to corrupted data, and on the other hand of detecting hidden
back doors which an attacker may have installed to give him access to the
computer at a later date.
Programs which calculate cryptographic checksums across a large proportion
of the files in the file system can be used for integrity checking. Tools offering
this functionality under Unix include the tripwire program, for example, some
versions of which are also available free of charge, or the tool developed on
behalf of the BSI for secure Unix administration (USEIT). Comparable
programs are also available for the Windows NT operating system. Apart from
the file system, it should also be possible to subject the registration keys to an
integrity test.
tripwire and USEIT can detect any change to a file system because the
checksums no longer match when a change has been made. They not only test
whether a file has been modified, they also detect any change to access rights,
or if data has been deleted and subsequently reloaded. Given a special setting,
all accesses to a file, even read accesses, can be detected in most cases.
In order to prevent the possibility of the program or checksum file being
corrupted by an attacker, they should be located on a data medium that
optionally allows only read access. However, the checksum file also has to be
changed when changes are made to the file system, so floppy disks are
recommended for small file systems and removable hard disks for larger
systems.
An integrity check should be performed regularly, for example every night.
Notification of the outcome should be sent automatically to the administrator
by e-mail, even if no changes have been detected.
Additional Controls:
- Which integrity checkers are used?
- How often are the results of the integrity checkers examined?
- How are the checksum file and the program itself protected against
manipulation?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000