Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:00 PM
Connect Directly

Report: No Magic Bullet For Database, Server Security

New Forrester report says encryption, data monitoring technologies key tools for now

There's no quick fix for securing data on databases and servers, and new tools that can prevent attacks on these systems are a long way off, according to a new report.

For the near term, encryption will remain the most popular defense for locking down data on databases and servers, while database monitoring and Web filtering will continue to be pervasive tools for breach detection, according to Forrester Research's new report.

Protecting data on servers and databases has never been easy, and doing so has become only more challenging with mobile users, cloud computing, and an unstable employment climate, says Jonathan Penn, vice president of tech industry strategy/security at Forrester, who co-authored the report with Forrester's Andrew Jaquith. "Over the foreseeable planning horizon, help for CISOs will not arrive in the form of a miracle tonic. Forrester does not foresee that a miraculous technology -- for example, error-free data discovery and classification -- will emerge to save the day," he says.

Instead, existing "brute force" tools, like encryption and data masking, will continue to emerge as the key tools to keeping data under wraps, while database monitoring and Web application filtering will provide insight into breaches. "While prevention may not prove practical in all cases, detection will be," Penn says. Compliance and contractual requirements will keep organizations buying those technologies, which "give them visibility to theft, corruption, and abuse as it happens," he adds.

The Payment Card Industry Data Security Standard (PCI DSS) and states' data breach disclosure laws are driving enterprises to adopt these data security technologies.

Meanwhile, enterprises aren't ready to deploy data discovery and classification technologies, Forrester says. The data discovery market won't mature for several years, Forrester says, even though the concept of crawling an enterprise network to find where the sensitive data lives should be a no-brainer by now in this age of big search engines.

Data classification, meanwhile, won't hit its stride until about 2014, when security-specific data classification tools will blend with knowledge management and electronic records classification technologies.

"Classification is a challenge because many different groups are looking at [it] from different perspectives and not coordinating their efforts," Penn says. The security, storage management, legal departments, and information/knowledge management groups all need these tools, but they won't make it into the organization until security/risk management and information/knowledge management team, he says.

"These groups will realize that by aligning their interests, they can be more effective, consolidate vendors, and cut costs," Penn says.

Plus, data classification tools, such as data protection, archiving/retention, e-discovery, and knowledge management, are very focused, he says. "For example, e-discovery classification tools have far less sophistication in their content analysis capabilities than the DLP [data leakage protection] tools security people are employing," he says. "Classification needs to be done in the infrastructure, across areas, so that a file managed by the archive system is classified the same way that a rights management [system] would classify it when deciding who can look at it, and the same way a DLP product would classify it when deciding whether a user can send it off to a USB or by email."

Forrester's report, "TechRadar For Vendor Strategy Professionals: Database And Server Data Security, Q2 2009," is geared for vendors looking at how to plan their strategies in this space.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-18
Huawei HEGE-560 version; OSCA-550 and OSCA-550A version; and OSCA-550AX and OSCA-550X version have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Succe...
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
PUBLISHED: 2020-02-18
HUAWEI Mate 20 smartphones with versions earlier than have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode.