046 – Manage the integrity of critical files

Summary

The system must verify and log changes in the integrity of critical system files.

Description

The integrity of critical files needs to be safeguarded against malicious tampering or unauthorized modifications. If an attacker successfully alters critical files, it could lead to data breaches, or the injection of malicious code into the system.

Supported In

Advanced: True

References

• CAPEC-13. Subverting environment variable values
• CAPEC-23. File content injection
• CAPEC-35. Leverage executable code in non-executable files
• CAPEC-38. Leveraging/Manipulating configuration file search paths
• CAPEC-154. Resource location spoofing
• CAPEC-176. Configuration/Environment manipulation
• OWASP10-A9. Security logging and monitoring failures
• OWASPM10-M2. Insecure data storage
• CERTJ-FIO00-J. Do not operate on files in shared directories
• NYSHIELD-5575_B_6. Personal and private information
• MITRE-M1025. Privileged process integrity
• PADSS-4_2_2. Actions taken by any individual with root or administrative privileges
• PADSS-4_2_6. Initialization, stopping, or pausing of the application audit logs
• PDPA-9B_48E. Improper use of personal data
• IEC62443-SI-3_1. Communication integrity
• NISTSSDF-PS_2_1. Provide a mechanism for verifying software release integrity
• NISTSSDF-PS_3_1. Archive and protect each software release
• ISSAF-Y_3_4. Database Security - Database services countermeasures
• HITRUST-09_ac. Protection of log information
• HITRUST-09_ad. Administrator and operator logs
• CASA-8_1_6. General Data Protection
• OWASPMASVS-RESILIENCE-1. Cryptography requirementsThe app validates the integrity of the platform
• NIST-RS_AN-07. Incident data and metadata are collected, and their integrity and provenance are preserved

Weaknesses

• 428 – Inappropriate coding practices - invalid file

Last updated

2024/03/05