Integrity Monitoring - Bitdefender Techzone

Several regulatory standards mandate the implementation of file and system-wide integrity monitoring. These regulations underscore the global importance of integrity in securing confidential and sensitive data. Some of the notable regulatory requirements include.

_{Figure 1: GravityZone Integrity Monitoring allows for various controls related to file creation, deletion, changes, ownership changes and more.}

Traditional cybersecurity tools, such as antivirus software and Extended Detection and Response (XDR) platforms, are invaluable assets in a comprehensive security approach. These tools primarily focus on identifying and mitigating known threats based on distinct signatures, heuristics, and behavioral patterns. In contrast, system-wide integrity monitoring technology shifts the approach slightly by guaranteeing the consistent state and integrity of system and application components.

By continuously checking for any unauthorized alterations to system and application configurations, Integrity Monitoring ensure systems and their components maintain a desired and secure state. This means that any deviation, regardless of whether it's caused by a known or a new unidentified threat, results in an immediate alert. Such monitoring can even detect anomalies that might slip past an antivirus or an XDR, especially in the case of zero-day exploits that don't fit any recognized pattern.

For instance, imagine a scenario where an administrator inadvertently modifies a security setting on a pivotal server. This action might leave the server vulnerable. While an antivirus or XDR might not immediately flag this change if no known malware tries to exploit this new vulnerability, the integrity monitoring tool would. It would alert the cybersecurity team about the unauthorized change, offering an opportunity to correct the issue proactively.

Similarly, consider a situation where a novel malware strain discreetly modifies a system file to ensure its persistence or to create a backdoor. If the malware's signature isn't recognized, traditional antivirus solutions might overlook it. An XDR might also miss it if the malware's actions don't match established behavioral patterns. Yet, the integrity monitor would pick up on the unauthorized change, drawing attention to the potentially compromised element.

Default rules are created and supported by Bitdefender. These rules cover critical operating systems, applications files and registry keys, assuring that the integrity of the system is secure without requiring extensive configuration by the administrator. Specific details of all entities that are monitored using the default rules can be found at our Bitdefender Support Center here.

Custom Rules allows security teams to specify the entities that they want monitoring and protected by GravityZone Integrity Monitoring.  The Custom Rules must be configured with the following fields:

Once the Entity Type is selected, additional configuration fields are made available that empower the security teams with monitoring and remediation tools against unauhtorized changes.

Detailed information about Integrity Monitoring configurations can be found at our Bitdefender Support Center here.

_{Figure 3: Entity Type configuration gives security teams extensive controls over how the entity is monitored and what remediation actions are taken if a change is detected.}

Through the rules, security teams can configure a plethora of automatic remediation options once an unauthorized change is detected:

GravityZone Integrity Monitoring has implemented restrictors with the sole purpose of reducing alert fatigue. These restrictors are designed to cover human errors.

For example, if you create a rule to monitor every .log file on your endpoint, Integrity Monitoring is not going to allow you to add it, and thus prevent the endpoint from being flooded by notifications and/or events.

Another key component of any suitable Integrity Monitoring technology is the ability to modify it’s performance impact on the system it is monitoring.  GravityZone Integrity Monitoring provides just that by providing organizations with three distinct processing profiles that can be configured through the Integiry Monitoring policies:

As organizations have systems with diverging processing power, it’s important that the Integrity Monitoring system can be fine-tuned to supervise those systems without negatively impacting their ability to perform their normal tasks.  Additionally, the variable performance settings allows for deduplication of alerts, and the capacity to reduce alert fatigue.

In Bitdefender GravityZone, a "policy" is a set of configurations that dictate how the security solution behaves on the devices where it's applied. The policy defines the security settings and rules for devices and users within a particular group or organizational segment.  GravityZone Integrity Monitoring allows security teams to assign different Rulesets to systems that govern what Integirty Monitoring rules are applied to the systems with the assigned policies.  Once the policies are applied, the endpoints start sending events to the GravityZone console and can then be reviewed from the Integrity Monitoring Events section of the console.

_{Figure 4:  The Integrity Monitoring Events sections lets security teams quickly review and asses IM events from endpoints}