IBM i environments support some of the most critical applications, processes, and data in an organization.
Protecting these environments requires more than controlling user access or securing network connections. Organizations also need visibility into what changes inside their IBM i environment.
A modification to a critical object or file may be legitimate. It may also be the result of unauthorized activity, compromised credentials, malware, ransomware, insider activity, or an application problem.
The challenge is determining the difference.
File Integrity Monitoring (FIM) provides a way to monitor changes to critical resources and investigate activity that may require attention.
With our solutions modules Audit, AP-Journal, and Action, organizations can build a practical approach to monitoring, investigating, and responding to changes on IBM i.
What Is File Integrity Monitoring?
File Integrity Monitoring is the process of monitoring critical files, objects, and resources for changes that may be unauthorized, unexpected, or suspicious.
A FIM strategy should help answer several fundamental questions:
- What changed?
- When did it change?
- Who performed the activity?
- What resource was affected?
- Was the activity expected?
- What action should be taken?
The objective is not to generate alerts for every change.
The objective is to provide meaningful visibility into changes that matter.
Why FIM Matters on IBM i
IBM i environments can contain:
- Critical applications
- Business data
- Database objects
- Application programs
- IFS files
- Configuration resources
- User and security information
- Financial information
- Customer information
Changes to these resources can have significant consequences. For example, an unexpected modification could indicate:
Compromised credentials: An attacker gains access using a legitimate account.
Insider activity: A user makes an unauthorized change.
Malware or ransomware: Malicious software modifies or encrypts files.
Application error: An application changes a resource unexpectedly.
Configuration error: An administrator unintentionally changes a critical setting.
FIM provides an additional layer of visibility to help identify these situations.
Journaling
One of the important technologies supporting FIM on IBM i is journaling.
IBM i journaling can record changes and activities associated with journaled objects and resources. This information can provide valuable evidence when investigating changes.
However, raw journal information can be difficult to turn into practical security intelligence.
This is where AP-Journal becomes relevant. AP-Journal uses IBM i journal information to provide security visibility into changes affecting monitored resources.
Audit the Activity
Audit provides security-event visibility across the IBM i environment. When investigating an unexpected change, security teams need more than the fact that a resource was modified.
They need context.
Our solution can help provide information about security-relevant activity, allowing teams to investigate questions such as:
- Who performed the activity?
- When did it happen?
- What type of activity occurred?
- What resource was involved?
- What other activity surrounded the event?
This audit information complements the change information provided through journaling.
Take Action
Detection is only one part of security.
When an organization identifies activity that violates a security policy, it may need to take action.
Action provides the ability to apply defined security controls based on monitored activity. This extends the FIM process from visibility toward response.
FIM and Compliance
Organizations in regulated industries often need to demonstrate that critical systems are monitored and that significant changes can be identified and investigated.
FIM can support security and audit processes associated with requirements and frameworks such as:
- PCI DSS
- SOX
- DORA
- NIS2
- GDPR
- Internal security policies
The specific controls required depend on the organization’s regulatory and business environment. FIM itself does not make an organization compliant. Instead, it provides an important capability for:
