During malware analysis, a tester takes a system snapshot before and after running the malware and monitors ports, processes, and event logs for changes. Which security practice is this an example of?

During malware analysis, a tester takes a system snapshot before and after running the malware and monitors ports, processes, and event logs for changes. Which security practice is this an example of?

• A. Host integrity monitoring
• B. Network intrusion detection
• C. File integrity monitoring
• D. Security information and event management

Answer: (A)

Host integrity monitoring focuses on detecting deviations in a system’s state by establishing a trusted baseline and watching for changes to the host itself. Taking a snapshot before running malware creates a reference point of which processes were present, which ports were open, and what the event logs looked like. After the sample runs, monitoring for any changes to those elements helps reveal unauthorized modifications and suspicious activity typical of malware behavior. This approach targets the integrity and configuration of the individual host rather than just files or network traffic, which is why it fits best. File integrity monitoring would concentrate on changes to files (via hashes or permissions) specifically. Network intrusion detection focuses on monitoring network traffic for anomalies. Security information and event management centers on aggregating and correlating events from many sources. The described practice centers on the host’s state and its changes, which is the essence of host integrity monitoring.

Host integrity monitoring focuses on detecting deviations in a system’s state by establishing a trusted baseline and watching for changes to the host itself. Taking a snapshot before running malware creates a reference point of which processes were present, which ports were open, and what the event logs looked like. After the sample runs, monitoring for any changes to those elements helps reveal unauthorized modifications and suspicious activity typical of malware behavior. This approach targets the integrity and configuration of the individual host rather than just files or network traffic, which is why it fits best.

File integrity monitoring would concentrate on changes to files (via hashes or permissions) specifically. Network intrusion detection focuses on monitoring network traffic for anomalies. Security information and event management centers on aggregating and correlating events from many sources. The described practice centers on the host’s state and its changes, which is the essence of host integrity monitoring.