topic Re: What operational capabilities file hashes can enhance? in Governance, Risk, Compliance

What operational capabilities file hashes can enhance?

Masahiro — Mon, 09 Oct 2023 09:59:48 GMT

According to the question c06.062 of CCSP Official Practice Tests, file hashes can enhance both operational capabilities and configuration management efforts.

What do you think of the operational capabilities in this case?

Its explanatory note says the following.

File hashes can serve as integrity checks for both configuration management (to determine which systems are not configured to the baseline) and audit purposes (as artifacts/common builds of systems for audit review).

It seems the note says the operational capabilities equal to audit capabilities, though.

Re: What operational capabilities file hashes can enhance?

Steve-Wilme — Mon, 04 Oct 2021 07:43:37 GMT

Conventionally configuration management includes the practice of configuration auditing, which is probably why.

Re: What operational capabilities file hashes can enhance?

Masahiro — Tue, 05 Oct 2021 10:51:32 GMT

@Steve-Wilme wrote:
Conventionally configuration management includes the practice of configuration auditing, which is probably why.

Thank you, Steve.

File hashes reveal integrity of original files. That is one of facets of configuration management. Right?

Re: What operational capabilities file hashes can enhance?

Pasuking — Thu, 07 Oct 2021 01:50:39 GMT

Masahiro,

I use hashing to verify the integrity of whitelisted applications before installation. It ensures users have not downloaded any other unapproved versions of the same application or simply added additional files to the file that could be used to cause chaos later on.

Angel Q

Re: What operational capabilities file hashes can enhance?

Masahiro — Thu, 07 Oct 2021 10:51:54 GMT

Thanks Angel!

Re: What operational capabilities file hashes can enhance?

Caute_cautim — Sun, 10 Oct 2021 19:50:52 GMT

@MasahiroIf you dig into the NIST SP800-167 Application Whitelisting, it is also used to check the validity of applications permitted into the system. You will also find a few manufacturers such as Juniper who have actually built in both Characterisation and Application Whitelisting into the Junos, for formally checking that software updates come from the correct resource, and also that someone has not manipulated the original updates.

Other solutions such as VMware Carbon Black does a similar series of checks too.

You will find similar techniques vouched and mandated by the Australian Information Security Manual and also by the New Zealand Information Security Manual too. Both are well worth digging through, as they are both online and available for searching purposes.

Regards

Caute_Cautim

Re: What operational capabilities file hashes can enhance?

Masahiro — Wed, 13 Oct 2021 08:55:06 GMT

Thank you for sharing your knowledge with me, @Caute_cautim .

Your reply made me much clearer about operational capabilities which file hashes can enhance.

Thanks!

Best regards,