Risk
12/18/2012
07:42 AM
Adrian Lane
Adrian Lane
Quick Hits
50%
50%

A Guide To Practical Database Monitoring

A look at what database activity monitoring can and can't do, and some recommendations on how to implement the best system for your organization

[Excerpted from "A Guide to Practical Database Monitoring," a new, free report posted this week on Dark Reading's Database Security Tech Center.]

Database activity monitoring, a form of application monitoring, examines how applications use data and database resources to fulfill user requests. DAM captures and records database events -- which, at minimum, includes all SQL activity -- in real time or near real time.

DAM is focused on the database layer, which allows for a contextual understanding of transactions, or how multiple database operations constitute a specific business function.

If you want to understand when administrators perform unauthorized alterations or view sensitive information, or be altered when systems are used in a manner inconsistent with best practices, DAM is a good choice.

DAM can even detect odd behavior that is hard to quantify but just doesn't look right -- such as when someone requests "too much" information or makes unusual requests.

It's the understanding of the database layer that allows DAM to provide both qualitative and quantitative analysis of events across multiple requesting applications and databases. It's this focus that allows DAM to provide value beyond traditional security information and event management or intrusion-detection systems, both of which collect generic system and network events.

DAM systems have been commercially available for more than a decade, and the platforms offer mature functions that scale with the IT systems they monitor. Here are the principal reasons companies use DAM products:

SQL Injection protection. DAM can filter and protect against many variants of SQL injection. While it does not provide completeprevention, statement and behavioral analysis techniques catch a great deal of known and previously unknown attacks. By whitelisting queries as acceptable from specific applications, DAM can detect most queries that have been tampered with and queries originating from unapproved applications.

DAM also can be deployed to block SQL injection and other attacks -- called "virtual patching"-- often before database vendors provide patches. Statements can be blocked before executing in the database, so there is no damage to data or the platform.

Behavioral monitoring. DAM systems capture and record activity profiles, both of generic user accounts and of specific database users. Detected changes in a specific user's behavior can indicate a disgruntled employee, hijacked accounts or even cases of oversubscribed permissions. Or maybe you're worried about attacks from mysterious Russian hackers or the much-hyped "insider threat." Behavioral monitoring is an effective technique to detect misuse, regardless of the source.

For a look at some of the other reasons why companies use DAM -- as well as a detailed guide on how to evaluate DAM products -- download the free report on database activity monitoring.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Things Every Business Executive Should Know About Cybersecurity
Don't get lost in security's technical minutiae - a clearer picture of what's at stake can help align business imperatives with technology execution.
Flash Poll
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Social engineering, ransomware, and other sophisticated exploits are leading to new IT security compromises every day. Dark Reading's 2016 Strategic Security Survey polled 300 IT and security professionals to get information on breach incidents, the fallout they caused, and how recent events are shaping preparations for inevitable attacks in the coming year. Download this report to get a look at data from the survey and to find out what a breach might mean for your organization.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Security researchers are finding that there's a growing market for the vulnerabilities they discover and persistent conundrum as to the right way to disclose them. Dark Reading editors will speak to experts -- Veracode CTO and co-founder Chris Wysopal and HackerOne co-founder and CTO Alex Rice -- about bug bounties and the expanding market for zero-day security vulnerabilities.