Perimeter
10/5/2009
12:57 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

Guardium Safeguards McAfee.com, Automates PCI Compliance Controls

McAfee is expanding its Guardium implementation to protect its SAP systems for Sarbanes-Oxley (SOX) compliance

WALTHAM, MA " October 1, 2009 - Guardium, the database security company, today announced that McAfee has successfully deployed Guardium's real-time database security and monitoring solution to safeguard sensitive cardholder data in its high-volume, business-critical McAfee.com environment.

McAfee.com processes millions of credit card transactions per year for McAfee's online stores, serving home, home office and small business consumers. The site also serves customers of McAfee's national ISP partners such as Comcast and Cox Communications, who have strict Service Level Agreements (SLAs). It is hosted in multiple world-class, geo-separated data centers hosting large-scale, clustered database systems.

"McAfee needed a solution with continuous real-time visibility into all sensitive cardholder data " in order to quickly spot unauthorized activity and comply with the Payment Card Industry Data Security Standard (PCI DSS) " but given our significant transaction volumes, performance and reliability considerations were crucial," said Tony Gunn, director of security engineering, McAfee. "We were initially using a database auditing solution that collected information from native DBMS logs and stored it in an audit repository, but granular logging significantly impacted our database servers and the audit repository was simply unable to handle the massive transaction volume generated by our McAfee.com environment.

The Guardium solution provided enterprise-class scalability in a solution and was deployed in less than 48 hours. In addition to safeguarding our customers' trust, Guardium's technology also automates our PCI database controls and reduces DBA workload while enforcing separation of duties to protect against both internal and external threats."

McAfee is now expanding its Guardium implementation to protect its SAP systems for Sarbanes-Oxley (SOX) compliance, as well as to safeguard other sensitive financial databases in the corporation. The company is also integrating Guardium with its correlation engine and enterprise-wide Security Information and Event Management (SIEM) platform to consolidate database security alerts and events into a single console.

Guardium's scalable platform uses centralized, cross-DBMS policies to immediately identify unauthorized or suspicious activities in real-time, without relying on database-resident logs that add overhead and can easily be disabled or modified by hackers or privileged insiders employing anti-forensic tactics. Guardium is a founding member of the McAfee Security Innovation Alliance, and its Guardium 7 platform has been integrated with McAfee ePolicy Orchestrator' (ePO) and has been awarded the "McAfee compatible" designation. SIA is a core element of McAfee's technology partner ecosystem, and was established in 2007 to increase the customer value of McAfee Security Risk Management (SRM) solutions.

Forrester Research named Guardium "a Leader across the board" in enterprise database auditing and real-time protection, with Guardium earning the #1 scores for Architecture, Current Offering and Product Strategy.

"We're very pleased that McAfee, the world's largest dedicated security technology provider, has selected Guardium to safeguard their brand and consumers' trust," said Ram Metser, Guardium CEO. "Safeguarding enterprise databases is a critical task which requires the right architecture and a robust solution derived from ongoing feedback from the most demanding data center environments worldwide. Guardium is committed to providing practical solutions that safeguard our customers' businesses while at the same time simplifying database security and compliance for their IT organizations."

Guardium will be a sponsor at next week's McAfee FOCUS event in Las Vegas.

"The Forrester Wave: Enterprise Database Auditing And Real-Time Protection, Q4 2007," October 2007

About Guardium Guardium, the database security company, delivers the most widely-used solution for ensuring the integrity of enterprise data and preventing information leaks from the data center.

The company's enterprise security platform is now installed in more than 450 data centers worldwide, including 5 of the top 5 banks; 3 of the top 5 insurers; top government agencies; 2 of the top 3 retailers; 15 of the world's top telcos; 2 of the world's favorite beverage brands; the most recognized name in PCs; a top 3 auto maker; a top 3 aerospace company; and a leading supplier of business intelligence software.

Guardium has partnerships with Accenture, ArcSight, BMC, EMC/RSA, IBM, McAfee, Microsoft, Oracle, Sybase and Teradata, with Cisco as a strategic investor, and is a member of IBM's prestigious Data Governance Council and the PCI Security Standards Council.

Founded in 2002, Guardium was the first company to address the core data security gap by delivering a scalable, cross-DBMS enterprise platform that both protects databases in real-time and automates the entire compliance auditing process.

Guardium and "Safeguarding Databases" are trademarks of Guardium, Inc.

Media Contacts: Corinne Federici and George Robertson Corporate Ink 617.969.9192 cfederici@corporateink.com groberston@corporateink.com

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.