Perimeter
10/5/2009
12:57 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Guardium Safeguards McAfee.com, Automates PCI Compliance Controls

McAfee is expanding its Guardium implementation to protect its SAP systems for Sarbanes-Oxley (SOX) compliance

WALTHAM, MA " October 1, 2009 - Guardium, the database security company, today announced that McAfee has successfully deployed Guardium's real-time database security and monitoring solution to safeguard sensitive cardholder data in its high-volume, business-critical McAfee.com environment.

McAfee.com processes millions of credit card transactions per year for McAfee's online stores, serving home, home office and small business consumers. The site also serves customers of McAfee's national ISP partners such as Comcast and Cox Communications, who have strict Service Level Agreements (SLAs). It is hosted in multiple world-class, geo-separated data centers hosting large-scale, clustered database systems.

"McAfee needed a solution with continuous real-time visibility into all sensitive cardholder data " in order to quickly spot unauthorized activity and comply with the Payment Card Industry Data Security Standard (PCI DSS) " but given our significant transaction volumes, performance and reliability considerations were crucial," said Tony Gunn, director of security engineering, McAfee. "We were initially using a database auditing solution that collected information from native DBMS logs and stored it in an audit repository, but granular logging significantly impacted our database servers and the audit repository was simply unable to handle the massive transaction volume generated by our McAfee.com environment.

The Guardium solution provided enterprise-class scalability in a solution and was deployed in less than 48 hours. In addition to safeguarding our customers' trust, Guardium's technology also automates our PCI database controls and reduces DBA workload while enforcing separation of duties to protect against both internal and external threats."

McAfee is now expanding its Guardium implementation to protect its SAP systems for Sarbanes-Oxley (SOX) compliance, as well as to safeguard other sensitive financial databases in the corporation. The company is also integrating Guardium with its correlation engine and enterprise-wide Security Information and Event Management (SIEM) platform to consolidate database security alerts and events into a single console.

Guardium's scalable platform uses centralized, cross-DBMS policies to immediately identify unauthorized or suspicious activities in real-time, without relying on database-resident logs that add overhead and can easily be disabled or modified by hackers or privileged insiders employing anti-forensic tactics. Guardium is a founding member of the McAfee Security Innovation Alliance, and its Guardium 7 platform has been integrated with McAfee ePolicy Orchestrator' (ePO) and has been awarded the "McAfee compatible" designation. SIA is a core element of McAfee's technology partner ecosystem, and was established in 2007 to increase the customer value of McAfee Security Risk Management (SRM) solutions.

Forrester Research named Guardium "a Leader across the board" in enterprise database auditing and real-time protection, with Guardium earning the #1 scores for Architecture, Current Offering and Product Strategy.

"We're very pleased that McAfee, the world's largest dedicated security technology provider, has selected Guardium to safeguard their brand and consumers' trust," said Ram Metser, Guardium CEO. "Safeguarding enterprise databases is a critical task which requires the right architecture and a robust solution derived from ongoing feedback from the most demanding data center environments worldwide. Guardium is committed to providing practical solutions that safeguard our customers' businesses while at the same time simplifying database security and compliance for their IT organizations."

Guardium will be a sponsor at next week's McAfee FOCUS event in Las Vegas.

"The Forrester Wave: Enterprise Database Auditing And Real-Time Protection, Q4 2007," October 2007

About Guardium Guardium, the database security company, delivers the most widely-used solution for ensuring the integrity of enterprise data and preventing information leaks from the data center.

The company's enterprise security platform is now installed in more than 450 data centers worldwide, including 5 of the top 5 banks; 3 of the top 5 insurers; top government agencies; 2 of the top 3 retailers; 15 of the world's top telcos; 2 of the world's favorite beverage brands; the most recognized name in PCs; a top 3 auto maker; a top 3 aerospace company; and a leading supplier of business intelligence software.

Guardium has partnerships with Accenture, ArcSight, BMC, EMC/RSA, IBM, McAfee, Microsoft, Oracle, Sybase and Teradata, with Cisco as a strategic investor, and is a member of IBM's prestigious Data Governance Council and the PCI Security Standards Council.

Founded in 2002, Guardium was the first company to address the core data security gap by delivering a scalable, cross-DBMS enterprise platform that both protects databases in real-time and automates the entire compliance auditing process.

Guardium and "Safeguarding Databases" are trademarks of Guardium, Inc.

Media Contacts: Corinne Federici and George Robertson Corporate Ink 617.969.9192 cfederici@corporateink.com groberston@corporateink.com

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8617
Published: 2015-03-04
Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/re...

CVE-2015-2209
Published: 2015-03-04
DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.

CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.