Risk

12/2/2009
02:18 PM
50%
50%

New Report Helps Enterprises Choose Their Own DAM Products

Study of database activity monitoring offers insights on how DAM products work -- and how to choose between them

[Excerpted from "Database Activity Monitoring: Emerging Technology Keeps Tabs On Assets," a new report published today in Dark Reading's Database Security Tech Center.]

When it comes to databases, there's one thing that all users agree on: a single breach can be devastating. One look at the security headlines will tell you that no company can afford a database leak.

One of the most promising technologies for security pros who are struggling to stay on top of this concern is database activity monitoring, or DAM. These systems enable organizations to monitor database events in real-time and quickly respond to unauthorized activity.

Some DAM products provide features for privileged-user monitoring and basic database auditing, two areas that have historically been underserved. Need more? The use of DAM technology is starting to be considered an essential control when demonstrating compliance with industry regulations and standards that require regular review of logs -- a category that includes PCI DSS, HIPAA, the Gramm-Leach-Bliley Act, FISMA, and Sarbanes-Oxley.

These products are still expensive; appliances run $25,000 to $50,000 per device, while agent-based offerings cost $5,000 to $25,000 per database. There are tough architectural decisions to be made, especially for distributed enterprises. Expect some turf warfare.

But because databases are increasingly targets for attackers, and few of us are willing to encrypt them, a DAM system might just be worth the investment.

In a nutshell, most DAM products monitor all SQL activity in real time across multiple database platforms and generate alerts based on policy violations. These systems also have the ability to aggregate -- and, to some degree, correlate -- activity from multiple heterogeneous database products, including Microsoft SQL Server and Oracle.

Some products also provide the additional benefit of monitoring and securely storing records of activity outside the target databases, which can come in handy if the systems housing these databases are ever compromised.

There are various technical approaches that enable DAM products to achieve these goals, but systems can be grouped into three primary categories: network monitoring, remote monitoring and local agent monitoring. Network monitoring products are typically delivered via appliances, whereas local agent monitoring DAM systems are software-based. For companies that need to do remote monitoring, native auditing is turned on for the target database, and the resulting activity log data is sent to an external appliance.

Choosing the best model is a matter of weighing the pros and cons of each approach and evaluating the database environment that you're looking to protect.

This calculation depends on your specific environment and overall goals. Using a combined approach to database monitoring provides the best coverage, but the involved nature of that type of deployment can be a scary proposition for some IT teams.

Organizations should first decide which threats they're the most concerned about. Do you think DBA/insider abuse is more likely than external manipulation of an application to do database dumping? Then catalog operational restrictions and dust off the debate over how comfortable you are with proactive blocking mechanisms.

DAM deployments require cooperation among multiple groups, and the dependencies on various IT specialties should not be underestimated. For example, for inline products, the network team will have to design and provision span ports on critical switches -- ports that, in some organizations, are in short supply.

With agent-based products, both system administrators and DBAs will need to be involved, as you'll be introducing yet another "moving part" on systems for which they are responsible. The larger the organization and more extensive the DAM deployment, the more people you'll need to bring to the table. CIOs should start getting those parties lined up early.

For more detailed insight on how to choose a choose a DAM product and how to deploy it, download the full report here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.