GUIDE (TRIPWIRE)FISMA SI-7 Buyer’s Guide

Evaluating Your Next Compliance Solution

The Federal Information Security Management Act (FISMA) tasks government agencies with a majororganizational, technological, and budgetary challenge. It can be hard to know how to best allocate youragency’s resources and talent to meet FISMA compliance, and a big part of that challenge is feeling confident
that you’re choosing the right cybersecurity and compliance reporting solution.

Fortra.com

Fortra Guide

This buyer’s guide focuses on one of the most difficult
security controls agencies must adhere to: NIST SP 80053 SI-7. The SI-7 (“SI” meaning “System Information
and Integrity”) control instructs agencies on software,
firmware and information integrity. As of 2017’s executive
order, “Effective immediately, each agency head shalluse The Framework for Improving Critical Infrastructure
Cybersecurity (the Framework) developed by the National
Institute of Standards and Technology, or any successor
document, to manage the agency’s cybersecurity risk.”1
Government systems are categorized as low, moderate orhigh sensitivity. All controls are mandatory for everyone, but
the set of mandatory controls gets larger for moderate- or
high-sensitivity agencies. The subset of SI-7 controls that are
most relevant to the largest numbers of agencies are 1, 2, 5
and 7. While an adequately-robust security and compliancesolution will cover all SI-7 controls, the following are thesubcontrols that typically require the most attention.

SI-7.1: Integrity Checks

As identified in NIST SP 800-53, “Security-relevant
events include the identification of new threats to whichorganizational systems are susceptible and the installationof new hardware, software, or firmware. Transitional states
include system startup, restart, shutdown, and abort.”2
Questions for your vendor:• Does it cover the full scope and range of assets,
including Windows, Unix, Linux, routers, switches, firewalls
and storage devices?
• Does the solution cover firmware? Can the solution
perform checks while systems are In transition?

FISMA SI-7 Buyer’s Guide• In environments with rapid provisioning, does thesolution integrate with virtualization, cloud and DevOps
tools so that it’s present when a new system is spun up?
• Can it detect the presence of a new threat (like a newhash) without having to rescan (i.e., in real time)?

SI-7.2: Automated Notifications ofIntegrity Violations

NIST SP 800-53 states, “The employment of automatedtools to report system and information integrity violations
and to notify organizational personnel in a timely matteris essential to effective risk response. Personnel with aninterest in system and information integrity violations
include mission and business owners, system owners, senioragency information security official, senior agency official
for privacy, system administrators, software developers,
systems integrators, information security officers, andprivacy officers.”
Questions for your vendor:• Can it detect and alert on changes in real-time?
Periodic scans can miss changes that are revertedback.
• Can It detect and alert on changes to attributes, suchas the actual time of file modification if real-time Is notavailable?
• Can it filter expected, accepted and routine change,
so as to only alert on changes that need to beinvestigated?
• Can it target changes that have been identified by
MITRE ATT&CK or other cybercrime frameworks, so as toproactively identify changes of greatest concern?

Examples of actionable integrity check results.
Fortra.com

Page 2Fortra Guide• Is the system capable of tracking ownership, mission,
management, FISMA group and location for each asset,
so as to be able to report and alert appropriately?

SI-7.5: Automated Response to Integrity
Violations
As identified in NIST SP 800-53, “Organizations may

define different integrity-checking responses by type of
information, specific information, or a combination of both.
Types of information include firmware, software, and user
data. Specific information includes boot firmware for certain
types of machines. The automatic implementation ofcontrols within organizational systems includes reversing thechanges, halting the system, or triggering audit alerts when
unauthorized modifications to critical security files occur.”
Questions for your vendor:• Does the solution have the ability to take action on theendpoint? Can you create actionable workflows?
• Can the solution create a ticket in an ITSM system (likeRemedy or ServiceNow) when required?
• Can the solution be instructed to act completely
automatically—to quarantine or otherwise disable asystem—in the case of serious anomalies (such as theappearance of a new executable)?
• Can the solution integrate with multiple sources of
threat intelligence data streams to detect and identify
malware and act accordingly?
• Can the solution capture the contents of systemfirmware? Can the system alert If there are deviations
from approved firmware?

FISMA SI-7 Buyer’s GuideS I - 7 C o n t r o l D e s c r i p t i o n a n d S u p p l e m ental
G u i d a n c e f r o m NI S TAccording to NIST SP 800-53, organizations
1.

Employ integrity verification tools to detect
unauthorized changes to the following software,
firmware, and information: [Assignment:
organization-defined software, firmware, andinformation]; and2. Take the following actions when unauthorizedchanges to the software, firmware, andinformation are detected: [Assignment:
organization-defined actions].
Unauthorized changes to software, firmware, andinformation can occur due to errors or malicious
activity. Software includes operating systems (withkey internal components, such as kernels or drivers),
middleware, and applications. Firmware interfaces
include Unified Extensible Firmware Interface (UEFI)
and Basic Input/Output System (BIOS). Information
includes personally identifiable information andmetadata that contains security and privacy
attributes associated with information. Integritychecking mechanisms—including parity checks,
cyclical redundancy checks, cryptographic hashes,
and associated tools—can automatically monitor the
integrity of systems and hosted applications.”­—National Institute of Standards and Technology2• Can it compare the state of an element at one time toits state at an earlier or later time?

SI-7.7: Integration of Detection andResponse• Can it present changes in a side-by-side format thatreadily enables the viewer to see insertions, deletions
and modifications from one point in time to another?

helps to ensure that detected events are tracked, monitored,• Does the system present the information in a way thatreadily supports documentation for further security
review or legal action?

NIST SP 800-53 states, “Integrating detection and response
corrected, and available for historical purposes. Maintaining
historical records is important for being able to identify anddiscern adversary actions over an extended time period andfor possible legal actions. Security-relevant changes include
unauthorized changes to established configuration settingsor the unauthorized elevation of system privileges.”
Questions for your vendor:• Does the solution create an initial baseline of each
asset? Are all monitored changes kept so that it’s
possible to review the history of changes over time?

Fortra.com• Does the system have the ability to assess authorizedchange vs. unauthorized change via integration to an
CM ticketing system?

Tools and Solutions for SI-7

To comply with SI-7, agencies must find a tool that not only
does integrity monitoring, but also automates notifications
and responses to violations and then keeps track of thoseviolations. That’s a lot to ask of a single solution, althoughpossible if it has a robust enough integrity monitoring toolkit.

Page 3Fortra Guide

Each and every data breach can be tracked to a file orconfiguration change. So if you can detect each new
unexpected change as it occurs, you can remediate it andreturn your system back to a secure, hardened baseline.
This FIM solution should provide you with:FISMA SI-7 Buyer’s Guide

More Key Questions for Your Vendor

Not all FIM solutions run the gamut of what you need to meetand maintain continuous SI-7 compliance. When speaking
to your compliance vendor, these essential questions will
help you determine the quality of the solution in question:• Visibility into new threats—Perform Integrity checks
against your systems during transition (SI-7.1)• Does it monitor the file and system integrity while also
covering the full scope and range of my assets?

• Real-time alerts on file and configuration changes (SI-7.2)• Does it generate automatic alerts as soon as a change
occurs on my files or configurations?

• Actionable event workflows that can isolate or shut
down non-compliant systems (SI-7.5)• Historical access to all deviations from approved
system baselines, track historical events (SI-7.7)
The table below offers a more granular look at the typesof change data your FIM solution should provide, and thebenefit to tracking each type.

• Does it walk you through remediation instructions tobring my systems back into compliance?
• Does it integrate with ITSM processes and other tools in
my IT ecosystem?
• How does this tool help streamline and optimize proof ofcompliance in the audit process?
• Can you run Compliance reports without the need torescan endpoints?
• Is the alerting and remediation capability robust enoughto help you maintain a defined compliant state?

Examples and Benefits of Change Details
Change Feature

Benefit

Monitor for changes with over 65 attributes of a file or configuration toconsider with attributes like file hash values (MD5, SHAH-1, etc.)

Deep understanding drives more accurate remediation

Version tracking to view each version of a file/configuration over a periodof timeHistorical understanding provides better decision making anddelivers audit-ready evidence

Ability to detect users making changes, without requiring native OS
auditing

Removes complexity of detecting changes

Ability to monitor any device with SSH or Telnet capabilities

Not complex and cumbersome since it’s agentless and discovers
difficult protocols

Scales to cover the entire IT stack (virtualization, cloud, physical/virtual
servers/desktops, applications (databases, directory services, web
applications, Exchange), network devices (routers, switches, firewalls andany other device that can utilize SSH)

Comprehensive coverage assures broad and deep security

Used wiht the Tripwire Dynamic Software Reconciliation app, Tripwire
Enterprise matches patch changes to patch manifests

Quickly zero in on changes that aren’t associated with patch
activity during the patch window

Understand good vs bad changes based on context from the change
management process and their potential impact on security

Minimize false positives, focus on the true problems

Automatically monitor changes on newly installed applications

Gain real-time change insights

Allowlist users, ports, services and applications, and alert/take action on
unauthorized matches

Comprehensive and fast detection of potential threats

Kill unauthorized processes, uninstall unapproved applications, and isolate
endpoints

Enforce integrity requirements and enhances security

Easily view side-by-side comparisons

Quick assessment of changes delivering faster remediation

Offers key insight into change events over a period of time

Gain better intelligence to make better decisions

Offers key insight into the vulnerability risks on assets

Better and faster risk assessments

Fortra.com

Page 4

Fortra Guide

Tripwire Enterprise andSI-7 Compliance

As a leading compliance solution provider, Fortra’s Tripwire
experts and engineers have ensured that implementing
Tripwire® Enterprise will align your agency with audit-readySI-7 compliance. Tripwire is the inventor of FIM. As such, fileand system integrity monitoring is at the core of what we’vebeen perfecting since 1997.
For over twenty-five years Tripwire has helped government
customers baseline the key configurations of their criticalsystems (including content, file attributes and hashes),detect changes to those files and configurations in real-timeand near real-time, and most importantly, to rapidly identify
which of the thousands/millions of changes taking placeeach day need to be investigated and/or remediated.
Of course, Tripwire Enterprise covers more than just theSI-7 subcontrols covered in this guide. Conversely, if you
only need FIM without Tripwire Enterprise’s policy andremediation capabilities, you can opt for Tripwire File
Integrity Manager instead.
This is how Tripwire Enterprise maps to the numerous
subcontrols:• SI-7.1: Tripwire directly provides SI-07 (1) controls forsoftware and hardware with real-time agent-based
file integrity management and critical change control.
Tripwire Enterprise provides monitoring rules andhardening policies that cover all aspects of the file system(including services, ports, firmware and command-based
configurations) to keep your systems secure.
• SI-7.2: In support of SI-07 (2), Tripwire Enterprise andTripwire LogCenter® provide a full suite of alerting andactionable event workflows should integrity violations
occur.
• SI-7.3: Tripwire Enterprise and Tripwire Log Center
support the enforcement of customer definedrequirements for SI-07(3) with centrally-managed
consoles which can be deployed to support onpremise, cloud-based and hybrid infrastructure models.
• SI-7.5: In support of SI-07 (5), Tripwire Enterprise andTripwire Log Center provide a full suite of alerting andactionable event workflows should integrity violations
occur. Actionable workflows can be set to isolate or shutsystems down in the event of a violation.

Fortra.com

FISMA SI-7 Buyer’s Guide• SI-7.6: Tripwire Enterprise meets SI-07(6) controls bycollecting and utilizing the MD5, SHA-1, SHA-256 or SHA512 hash values on all file system elements it monitors.
It then alerts if a change occurs that reflects a deviationfrom those hashes. Tripwire products also leverage
FIPS-140-2 and TLS for fully-encrypted communications.
• SI-7.7: Tripwire products directly provide SI-07 (7)controls for software and hardware with real-time
agent-based file integrity management and criticalchange control. Tripwire Enterprise offers cybercrimeand MITRE ATT&CK dashboards that can monitor
security-relevant changes of interest to the agency,
regardless of whether or not those changes trigger achange to policy compliance.
Tripwire products also provide monitoring rules
and hardening policy that cover all aspects of thefile system—including services, ports, firmware andcommand-based configurations—to keep your systems
secure. We also provide a full suite of event collection,
normalization, correlation and reporting techniques. Our
monitoring includes a full set of response alerting andactionable workflows which can isolate systems should
the need arise.
• SI-7.8: Tripwire Enterprise and Tripwire Log Center
support the enforcement of customer defined SI-07(8)control policies and procedures by monitoring all
aspects of the file system. Actionable workflows canbe set to isolate or shut systems down in the event of aviolation. Tripwire Enterprise has the ability to capture
and forward audit events to Tripwire Log Center, or toone of many other SIEM tools on the market.
• SI-7.9: Tripwire Enterprise and Tripwire Log Center
support the enforcement of customer-defined SI07(9) control policies and procedures by monitoring
items such as startup tasks, scheduled tasks, cronjobs, firmware changes and more. Tripwire Enterprisemaintains a baseline of critical system components
and will alert when any deviation from that baseline
occurs. Tripwire Enterprise also Includes the ability toperform integrity checks at boot to ensure no tampering
has occurred.
• SI-7.10: Tripwire Enterprise supports SI-07(10) by
providing firmware rules which can be used to identify,

Page 5Fortra Guide

FISMA SI-7 Buyer’s Guide

alert and take action against detected baselined(without source code present). Tripwire will alert in real

firmware changes at boot. Tripwire Enterprise can also

time when software that is unauthorized is installed

run integrity checks against installed software, startup

or executed. We do this by 1) baselining services andand scheduled tasks, or any other defined task at boot,or processes that are authorized on endpoints andhelping to ensure the systems integral state has notalert when new services or processes startup, and 2)changed. Tripwire Log Center supports both aspects

using our optional allowlisting capabilities to allowof event collection and alerting related to changes toalerting when unauthorized software or services are

firmware. It is critical to note that Tripwire Enterpriseinstalled or running. While Tripwire Enterprise does notwill also alert when new binary files are added to yourblock software from executing, it can stop softwaresystem for the purpose of malicious activity.

from running or take actions to delete software, move• SI-7.11: Tripwire products can run with limited privileges,
with monitoring abilities set by the privileges assigned.
Tripwire also supports SI-07(11) by providing both

software to quarantine and isolate systems once
detected..
• SI-7.15: Tripwire Enterprise includes rules that validate

rules and policy tests which can be used to collect all

trusted certificate authorities and policies that validate

attributes related to limited privileges on file system

CA Cert directory and file settings, as well as root

components. Tripwire will alert when user definedcertificates, LSA authentication and security packages,

privileges change or are altered. Tripwire Enterprise andand many others.

Tripwire Log Center function well in confined physicallocations and in virtual environments.
• SI-7.12: Tripwire’s allowlisting capabilities can ensureuser installed software is authorized by a defined“allowlist” of authorized software, and alert and takeaction on software which is not authorized. We also
support this requirement by ensuring the primary
components for installed software have not been
modified from their baseline at installation. Once
software is installed, Tripwire Enterprise can baseline,
monitor, and alert in real time if components of thatsoftware have been modified, ensuring admins that thesoftware is valid and not compromised. Tripwire canalso compare software packages to the same software
packages on other systems.
• SI-7.13: Tripwire products support SI-07(13) with rules
and policy tests which can be used to monitor software
components (including configuration files and fileattributes) for software with limited or no warranty, orfrom unknown sources. Tripwire products will alert whenchanges to those software components occur. Tripwire
can also alert if software is installed/running on systems
it is not authorized to execute on.
• SI-7.14: Tripwire Enterprise can prohibit the use ofsoftware from sources with limited or no warranty

Fortra.com• SI-7.16: Tripwire Enterprise supports this by monitoringchanges to task and cron schedulers. Tripwire does
not set timers on software that is running, but can alert
when software is started or stopped.
• SI-7.17: Tripwire Enterprise can support this control byensuring deployed software is authorized, and thathash Information on software installers matches known
cryptographic algorithms. In addition to ensuring the
integrity of deployed software and support binaries,
Tripwire’s allowlisting capabilities can ensure deployedsoftware is only operating through authorized ports
assigned to the software. Tripwire also offers a
Pen Testing service where a team of highly-skilledcybersecurity experts utilizes a combination of tacticaland strategic approaches to discover and exploit
vulnerabilities in your IT systems.
In short, Tripwire Enterprise—deployed out of box—has theability to discover and act upon suspected cyberattacks.
It can baseline files, directories, registries, and software
components. Tripwire Enterprise can also baseline accepted
listening ports and authorized software, ports, services,
processes, and users—for instance, it will send alerts andtake action when new listening or established port sessions
take place. Our cybercrime capabilities help to keep yoursystems safe and secure.

Page 6

Fortra Guide

FISMA SI-7 Buyer’s Guide

References

1 https://www.dhs.gov/executive-order-strengtheningcybersecurity-federal-networks-and-critical-infrastructure
2 https://nvd.nist.gov/800-53/Rev4/control/SI-7

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-gd-0623-r1-hm)