uziais asked a question.
Hello.
As part of the performance of official duties, it is necessary to implement a process to control the integrity of the software.
In the documentation, in particular on the Software Recognition Service, there is no information about the implementation of this functionality.
In our understanding, this process is usually implemented using a hash-function, which periodically calculates the hash-value of the installed software.
So, with the possible impact of malware on installed applications, this process detects a change in the hash-value,
which indicates a violation of the integrity of the controlled software.
Please inform us about the presence/absence of the implementation of the software integrity control process in the Snow SOFTWARE ASSET MANAGEMENT product.
If there is this process, please send documents (or send a link to a specific guide, section, page) on the use of the process in the work.
I'm not sure you'll get what you need, simply because the Snow agent will be looking at the various bits of information provided by the operating system as to what is installed.
When I review the uninstall hive in say a windows registry there is no mention of hash values to ensure the string is genuine or the files it relates to are. So if the OS doesn't present this information then no SAM toolset will be able to gather it.
Are you able to provide examples in say a Windows machine registry where this information is stored? and does it differ from machine to machine?
Yeah, I thought of adding that to the Ideas Board.
Ideally, each distinct record in the SLM database's tblSoftware table would have a hash added which would be requested next day from one of the agents who reported it. The consequence would be much higher resources used by the agent (disk I/O and processor) and much longer scan times. This would then require each client to compare hashes so a value should be stored locally to avoid overloading SQL with this task ... a bit overkill.