Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

New Report Helps Enterprises Choose Their Own DAM Products

Study of database activity monitoring offers insights on how DAM products work -- and how to choose between them

[Excerpted from "Database Activity Monitoring: Emerging Technology Keeps Tabs On Assets," a new report published today in Dark Reading's Database Security Tech Center.]

When it comes to databases, there's one thing that all users agree on: a single breach can be devastating. One look at the security headlines will tell you that no company can afford a database leak.

One of the most promising technologies for security pros who are struggling to stay on top of this concern is database activity monitoring, or DAM. These systems enable organizations to monitor database events in real-time and quickly respond to unauthorized activity.

Some DAM products provide features for privileged-user monitoring and basic database auditing, two areas that have historically been underserved. Need more? The use of DAM technology is starting to be considered an essential control when demonstrating compliance with industry regulations and standards that require regular review of logs -- a category that includes PCI DSS, HIPAA, the Gramm-Leach-Bliley Act, FISMA, and Sarbanes-Oxley.

These products are still expensive; appliances run $25,000 to $50,000 per device, while agent-based offerings cost $5,000 to $25,000 per database. There are tough architectural decisions to be made, especially for distributed enterprises. Expect some turf warfare.

But because databases are increasingly targets for attackers, and few of us are willing to encrypt them, a DAM system might just be worth the investment.

In a nutshell, most DAM products monitor all SQL activity in real time across multiple database platforms and generate alerts based on policy violations. These systems also have the ability to aggregate -- and, to some degree, correlate -- activity from multiple heterogeneous database products, including Microsoft SQL Server and Oracle.

Some products also provide the additional benefit of monitoring and securely storing records of activity outside the target databases, which can come in handy if the systems housing these databases are ever compromised.

There are various technical approaches that enable DAM products to achieve these goals, but systems can be grouped into three primary categories: network monitoring, remote monitoring and local agent monitoring. Network monitoring products are typically delivered via appliances, whereas local agent monitoring DAM systems are software-based. For companies that need to do remote monitoring, native auditing is turned on for the target database, and the resulting activity log data is sent to an external appliance.

Choosing the best model is a matter of weighing the pros and cons of each approach and evaluating the database environment that you're looking to protect.

This calculation depends on your specific environment and overall goals. Using a combined approach to database monitoring provides the best coverage, but the involved nature of that type of deployment can be a scary proposition for some IT teams.

Organizations should first decide which threats they're the most concerned about. Do you think DBA/insider abuse is more likely than external manipulation of an application to do database dumping? Then catalog operational restrictions and dust off the debate over how comfortable you are with proactive blocking mechanisms.

DAM deployments require cooperation among multiple groups, and the dependencies on various IT specialties should not be underestimated. For example, for inline products, the network team will have to design and provision span ports on critical switches -- ports that, in some organizations, are in short supply.

With agent-based products, both system administrators and DBAs will need to be involved, as you'll be introducing yet another "moving part" on systems for which they are responsible. The larger the organization and more extensive the DAM deployment, the more people you'll need to bring to the table. CIOs should start getting those parties lined up early.

For more detailed insight on how to choose a choose a DAM product and how to deploy it, download the full report here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We need more votes, check the obituaries.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3317
PUBLISHED: 2021-01-26
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
CVE-2013-2512
PUBLISHED: 2021-01-26
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
CVE-2021-3165
PUBLISHED: 2021-01-26
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
CVE-2021-1070
PUBLISHED: 2021-01-26
NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an un...
CVE-2021-1071
PUBLISHED: 2021-01-26
NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to...