Risk

New Report Helps Enterprises Choose Their Own DAM Products

Study of database activity monitoring offers insights on how DAM products work -- and how to choose between them

[Excerpted from "Database Activity Monitoring: Emerging Technology Keeps Tabs On Assets," a new report published today in Dark Reading's Database Security Tech Center.]

When it comes to databases, there's one thing that all users agree on: a single breach can be devastating. One look at the security headlines will tell you that no company can afford a database leak.

One of the most promising technologies for security pros who are struggling to stay on top of this concern is database activity monitoring, or DAM. These systems enable organizations to monitor database events in real-time and quickly respond to unauthorized activity.

Some DAM products provide features for privileged-user monitoring and basic database auditing, two areas that have historically been underserved. Need more? The use of DAM technology is starting to be considered an essential control when demonstrating compliance with industry regulations and standards that require regular review of logs -- a category that includes PCI DSS, HIPAA, the Gramm-Leach-Bliley Act, FISMA, and Sarbanes-Oxley.

These products are still expensive; appliances run $25,000 to $50,000 per device, while agent-based offerings cost $5,000 to $25,000 per database. There are tough architectural decisions to be made, especially for distributed enterprises. Expect some turf warfare.

But because databases are increasingly targets for attackers, and few of us are willing to encrypt them, a DAM system might just be worth the investment.

In a nutshell, most DAM products monitor all SQL activity in real time across multiple database platforms and generate alerts based on policy violations. These systems also have the ability to aggregate -- and, to some degree, correlate -- activity from multiple heterogeneous database products, including Microsoft SQL Server and Oracle.

Some products also provide the additional benefit of monitoring and securely storing records of activity outside the target databases, which can come in handy if the systems housing these databases are ever compromised.

There are various technical approaches that enable DAM products to achieve these goals, but systems can be grouped into three primary categories: network monitoring, remote monitoring and local agent monitoring. Network monitoring products are typically delivered via appliances, whereas local agent monitoring DAM systems are software-based. For companies that need to do remote monitoring, native auditing is turned on for the target database, and the resulting activity log data is sent to an external appliance.

Choosing the best model is a matter of weighing the pros and cons of each approach and evaluating the database environment that you're looking to protect.

This calculation depends on your specific environment and overall goals. Using a combined approach to database monitoring provides the best coverage, but the involved nature of that type of deployment can be a scary proposition for some IT teams.

Organizations should first decide which threats they're the most concerned about. Do you think DBA/insider abuse is more likely than external manipulation of an application to do database dumping? Then catalog operational restrictions and dust off the debate over how comfortable you are with proactive blocking mechanisms.

DAM deployments require cooperation among multiple groups, and the dependencies on various IT specialties should not be underestimated. For example, for inline products, the network team will have to design and provision span ports on critical switches -- ports that, in some organizations, are in short supply.

With agent-based products, both system administrators and DBAs will need to be involved, as you'll be introducing yet another "moving part" on systems for which they are responsible. The larger the organization and more extensive the DAM deployment, the more people you'll need to bring to the table. CIOs should start getting those parties lined up early.

For more detailed insight on how to choose a choose a DAM product and how to deploy it, download the full report here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.