[Autogenerated] requirement 11.5 aims to detect changes in
files that shouldn't ordinarily change because this could be
an indicator of malicious activity.
This requirement used to say, deploy file integrity monitoring software,
but it was changed version 3D to allow for any way of detecting
changes to files and types of files where you want to monitor and
detect for changes of these critical system files.
Such Aziz the operating system, libraries and applications configuration files,
which would affect the security of the system and then content files,
which, for example,
you know you could modify a content file to deliver
malware to a user or to a customer.
Obviously,
the type of file monitored by change detection systems is
going to vary from system to system.
If you've ever managed a system where this is in place,
you will know it's critical that is integrated with your patching systems and is
correctly set up to prevent lots of false positive alerts.
The system needs to generate alert when there is an
unauthorized modification to a file, and if the system doesn't run real time,
it must at least check systems.
The changes once a week.
The que se is going to look at the configuration of the
change detection mechanism by examining its configuration and
also looking at historical alerts.
But it should also look the system produces alerts when it should
do when there's an unauthorized modification.
It's these alerts that are the focus for requiring 11.5 point one,
which demands that there should be a process to respond to.
Alerts generated by the change detection software on the QC.
Here is simply going to chat with people to make sure
those alerts error investigating resolved.
Which of course, may not always happen,
because often the integrity monitoring software is so
badly configured and maintained.
The security operations team get 500 alerts today from it,
especially on patch days, for which they just completely ignore.
So look Q.
SATA is no.
This is one requirement where they have to look
particularly closely at how the alerts error produced on
whether those alerts error responded to