All common area programs should be reviewed daily, with cross-checks against the known checksums. Changes should be logged. These areas include /bin, /sbin, /usr/bin, /usr/sbin and any additional common areas, such as /usr/local and /opt.