Detection

• Integrity checkers (e.g. Tripwire)

  • Monitors files and directories for changes

  • Good for detecting defacements

  • Relatively inexpensive

  • Not "real-time"

  • Not for detecting other types of attacks

  • Doesn't block attacks