8.6 an example of a host-based intrusion detection tool is the tripwire program. this is a file integrity checking tool that scans files and directories on the system on a regular basis and notifies the administrator of any changes. it uses a protected database of cryptographic checksums for each file checked and compares this value with that recomputed on each file as it is scanned. it must be configured with a list of files and directories to check and what changes, if any, are permissible to each. It can allow any log file to have new entries appended, but not for existing entries to be changed.

What are the advantages and disadvantages of using such a tool?