Why are snapshot comparisons not adequate?
By definition, a “snapshot” is a large sample of the entire infrastructure. This sample may be comprised of several thousand files and directories. Determining which files in the snapshot should never change and which are permitted to change-within certain parameters-is a daunting task. In reality, system administrators tend to endorse all deviations found during successive snapshots, resulting in a snapshot that actually contains unauthorized executables or configuration changes. Only by examining each change and automatically applying a policy engine to the delta can the appropriate action be decided.
