SOLUTION BRIEF (TRIPWIRE)

Leveraging the Power of File Integrity
Monitoring

Using Tripwire Enterprise to Detect Change and Make it
Actionable
With pressure on IT departments to remain lean and efficient, comply topolicies and regulations, and also provide reliable 24/7 service, it is imperativethat companies large and small adopt solutions and processes to ensurea known and trusted state at all times. With the reliance on technology toconduct business, interact with customers, and meet auditing requirements,“store doors” need to remain open at all times. That’s why thousands oforganizations worldwide have turned to Fortra’s Tripwire for IT security andcompliance automation solutions that detect and identify the changes thatcan jeopardize compliance, security and operations.

Do You Know What Changed, Who Changed It, andWhen?
File integrity monitoring (FIM) is a method for tracking every change madeacross the data center. Some IT managers may wonder why it is important
to know about every change, especially given that most systems experiencehundreds, thousands, or even tens of thousands of changes every week. Toauditors, tracking every change is crucial, as uncontrolled change meansrisk. A handful of risky changes that can cause system failure, and just one illadvised change can lead to compliance degradation, security vulnerabilities
and service availability issues.
With FIM, there is complete visibility to all change, a record of who madechanges, and an audit trail that gives you the data to quickly troubleshootproblems—suspect changes can be quickly identified and resolved. Being
able to quickly pinpoint problem changes and streamline the troubleshooting
process is one of the most effective uses of change auditing. But as Tripwire’s
customers have discovered, the benefits an IT organization receives from theirsecurity and compliance automation solutions are much more far-reaching.

Fortra.com“Tripwire Enterpriseacts like a radar gun,constantly on the alert
for unauthorized andundocumented change.
It’s nice to know I don’t
have to worry about
unknowns. All I have to
do is look at theTripwire report.”—VML,
Full-service digitalmarketing agency

Fortra Solution Brief

Leveraging the Power of File Integrity Monitoring

Tripwire: The Pioneer in File Integrity
Monitoring

Tripwire provides software solutions to help you achieve
and maintain the integrity of all your IT configurations. Fileintegrity monitoring makes change visible by detecting allchanges across the breadth and depth of the data center,including virtual environments. It scans systems to create abaseline report, then compares subsequent scan results tothat baseline and reports changes, resulting in a verifiable
audit trail and version history of each system’s state.
Tripwire® Enterprise accommodates a broad range of userdefined policy criteria to enable its automated filtering ofchanges. Authorized changes can be defined in a varietyof ways: those made within specified time windows, madeby authorized users, correlated to change tickets and/ormatching pre-tested changes, etc. Tripwire Enterprise also
takes into account that not all changes are equal. It canenforce specific criteria based on the type of change (e.g.,“Business As Usual” vs. Emergency) and type of system (e.g.,a SOX server vs. email server).
Those customers wishing to complement their change andconfiguration automation tools with Tripwire Enterprise doso by using Tripwire’s integrations with popular enterprisechange ticketing systems, such as BMC Remedy andHP OpenView. A flexible API is also available to facilitate
integration with home-grown solutions. Tripwire’s standard
integration methods, including Tripwire Reconcile Express,
make it easy to align security and compliance automation
with your existing processess.

The Role of Change Audit in Security,Compliance and IT Operations
High performing IT organizations know that to help avert

data center problems, they must have complete visibilityof change. This visibility helps them maintain a known andtrusted state for compliance, security and IT operations.

Security

Security professionals widely recognize that IT configuration
integrity is fundamental to a sound security strategy. FIM
is core to a security plan since intrusions may occur for anindefinite amount of time without change auditing actively
monitoring the enterprise. Tripwire Enterprise not only tracks
every change made across the IT infrastructure, in both
physical and virtual environments, it lets you know whatchanged and who made the change. This information isprovided through Tripwire reports and dashboards, which
can be customized to your needs (such as severity of risk).
Knowing who made the changes can also be used to review
access privileges.

CHALLENGE

HOW TRIPWIRE ENTERPRISE HELPS

80% of unplanned downtime is caused
by unauthorized change

Tripwire Enterprise tracks every change across the data center, alerting you to unauthorized
or suspect changes that can cause downtime. Tripwire file integrity monioring is completely
tunable to your processes.

80% of the time taken to restore services
is spent discovering what changed

Tripwire Enterprise lets you know what changed, when it changed and who made thechange. This drastically reduces firefighting, troubleshooting and mean time to repair.

Intrusions may occur for an indefinite
amount of time without notice

Tripwire’s file integrity monitoring automatically and actively monitors the enterprise forsuspect changes, alerting staff for immediate investigation and remediation.

Change and configuration management
processes are frequently circumvented,
leading to unauthorized change that
increases the risk of system compromise

Tripwire Enterprise ensures that all changes are made through expected tools andprocesses by automatically correlating changes with other configuration and changeautomation systems in order to better identify authorized and unauthorized change.

Auditors are increasingly aware thatstrong IT controls are predicated onstrong change and security controls

Tripwire Enterprise’s automated change detection, ongoing documentation of change
history and online reporting capabilities provide preventive and detective controls that
continuously ensure safeguards are in place and working effectively.

Auditing processes are now frequent and numerous,
eating up resources and increasing IT costs

Auditors recognize Tripwire Enterprise and its reputation as a proven automated control,and consequently spend less time questioning and inspecting. They know that with Tripwire
Enterprise in place, there is proof whether or not change is properly managed.

Fortra.com

Page 2Fortra Solution Brief

Leveraging the Power of File Integrity Monitoring

Compliance

PHYSICALINFRASTRUCTURE

Compliance can no longer be considered a once a year
event, but rather an ongoing, continuous process. WithVIRTUALINFRASTRUCTURE
Applications

Tripwire’s FIM capabilities, the audit process is automatedand streamlined, expedited through detailed change history
and reporting. Because all change is tracked and an audit

Directory Services

trail created, auditors can quickly be given proof of howchanges are managed. When combined with Tripwire

Databases

Enterprise’s compliance policy management capabilities,
each change is proactively tested to ensure it is within

File Systems, Midsize and Desktops

internal and/or external policy. Tripwire makes this powerful
information actionable by alerting you when a change

Hypervisors and VMs

does not meet policy and can go as far as to create a newincident request within your existing change management

Network Devices and vSwitchessystem so it can be investigated further. Whether you arefacing PCI, SOX, FISMA, NERC, Basel II, JSOX, GLBA or internal
audits, Tripwire’s market-leading solution can make the

Tripwire’s file integrity monitoring capabilities ensure that all changes aredetected across the entire datacenter, no matter the source. From businesscritical applications to operating systems, databases, network devices, virtualenvironments and hypervisors, one point of control provides the visibility andcontrol necessary to automate compliance, mitigate security risks and increase
operational efficiency.

process easier, more accurate and cost effective.

ERP Changes By Severity

ERP Nodes With Changes
7/17/19 4:19 PM
Not applied
Not applied
NoNo
Not applied
ERP, esx4se.pdxse.tripwire.com, onlinecollab.srv1.tripwir
e.com
Not applied
Not appliedAll
Not applied
Not applied
Not applied
Demo Data Equals Yes
Added, Modified, Removed
All
No
All time
Not applied
Severity, descending
Count, descending
Name, descending

Date:
Promotion Approval ID:
Change window:
Use strict package match:
Display criteria at end:
Element Exists:
Nodes:
Node name:
Node Properties:
Rules:
Rule name:Element name:Element Properties:
Version Properties:
Change types:
Severity range:
Current versions only:
Time range:
Packages:
Severity sections sort:
Details table sort:
Details table (2nd) sort:

Date:
Promotion Approval ID:
Change window:
Use strict package match:
Display criteria at end:
Element Exists:
Nodes:
Node name:
Node Properties:
Rules:
Rule name:Element name:Element Properties:
Version Properties:
Change types:
Severity range:
Current versions only:
Time range:
Packages:
Details table sort:

7/20/19 1:16 PM
Not applied
Not applied
NoNoNot applied
ERP
Not applied
Not appliedAll
Not applied
Not applied
Not applied
Demo Data Equals Yes
Added, Modified, Removed
1 - 10000
NoAll time
Not appliedName, ascending

High SeverityNameType

Last Change Time

DEMOSERVER.PDXSE.TRIPWIRE.COM

Windows Server

11/7/18 1:31 PMCount
2
Severity Total: 2

The Change Process Compliance report identifies
authorized and unauthorized changes to nodes
over time, showing effectiveness of change processcontrols.

Fortra.com

The Changes by Severity report identifies
configurations that have deviated from baseline byuser-defined severity levels.

The Nodes with Changes report provides a quick
overview of authorized vs. unauthorized changes.

Page 3Fortra Solution Brief

Leveraging the Power of File Integrity Monitoring

IT Operations

80% of unplanned downtime is caused by unauthorizedchange and 80% of the time taken to restore services is spent
discovering what changed in the first place. Therefore, system
availability is dependent upon how well an organization
manages change. Tripwire Enterprise tracks every change
across the data center—and identifies who made eachchange. This enables organizations to enforce a zero-tolerance
for unauthorized change, thereby quickly eliminating thenumber one source of downtime. If a system outage does
occur, FIM can help the organization immediately pinpoint theproblem and inform rapid remediation.

Summary

Change is necessary not only to keep up with day-to-day
operational evolution, but also to enable IT to transform theorganization. As the business continues to demand change,“Now, instead of spending as
many as 28 man-days over ayear providing manual proofof change control, we simplyreview our Tripwire Enterprise
implementation and show
evidence of compliance acrossthe infrastructure with Tripwire
reports. As a result, we now
spend about an hour per audit
answering questions about ourchange processes. That’s areduction of nearly 90%!”—EdFinancial Services

it’s in its own best interest to get control of the changes
that pose potential risk. Tripwire’s file integrity monitoring
empowers IT professionals with the capability to improveand enforce change and configuration management
policies and procedures to ensure compliance withinternal governance, external regulatory requirements, andindustry best practices. By adopting Tripwire IT security andcompliance automation solutions, organizations achievea known and trusted state by automating compliance,

INTERESTED IN LEARNING
MORE ABOUT FIM?
F o r m o r e o n T r i p w i r e ’ s m a r k e t i n g - leading
F I M t e c h n o l o g y , r e a d M e e t i n g t h e Tr ue
I n t e n t o f F i l e I n t e g r i t y M o n i t o r i n g a nd visitt r i p w i r e .c o mmitigating security risk and improving operational efficiency.

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-ds-0723-r1-hm)