Hack the Route Start free Open app Hardening and auditing
File integrity monitoring
Recording a fingerprint of trusted files while a host is known-good, then checking later which ones have changed.
A file-integrity monitor (AIDE, Tripwire) takes a fingerprint — size, owner, permissions, a content hash —
of every file it watches while the host is known-good, and stores it as a baseline. Later it recomputes those
fingerprints and reports any that no longer match: a changed binary, an edited config, a new or removed file. It is
detection, not prevention — the change has already happened when the check reports it — but it catches tampering
that a vulnerability scan would miss, such as a trojaned system file or an attacker's edit to sshd_config. The
baseline must be taken while the host is trusted and stored where the attacker cannot quietly update it, or the
tampering is baked in.