Database monitoring - First and Last Line of Defense

In the battle to defend your data you have an edge over the hacker that can prevent or minimize the damage of a database breach. You have the advantage of operating within your own environment and can deploy automated surveillance capabilities to watch sensitive data. When a hacker breaches the firewall or compromises a privileged user they are beyond the reach of most security measures. Only a data centric solution that directly monitors data access will be able to spot and stop the abnormal activity.

View this presentation to learn how SecureSphere data protection solutions can help you improve your security profile and protect your company against a database breach.

1. ©"2015"Imperva," Inc."All"rights"reserved.
Database"Monitoring
First"and"Last"Line"of"Defense
Cheryl"O’Neill
November"12,"2015

2. ©"2015"Imperva," Inc."All"rights"reserved.
Speaker
2
Cheryl'O’Neill
Director,"Product"Marketing,
Database"Security,"Imperva
Cheryl"is"a"15Jyear"information"security"
and"compliance"technologist,"working"
with"the"largest"financial"services,"life"
science"and"Fortune"500"companies"to"
safely"secure"their"most"sensitive"and"
regulated"data."In"her"current"role,"
Cheryl"manages"the"Imperva"
SecureSphere"data"security"solutions.

3. ©"2015"Imperva," Inc."All"rights"reserved.
Why"You"Should"Protect"and"Audit"Critical"Data
1.Data"breaches"are"getting"more"expensive
2.More"regulations,"and"more"costly"penalties
3.Your"personal"employee"data"is"at"risk
3
Business'social,'and'personal'consequences

4. ©"2015"Imperva," Inc."All"rights"reserved.
Challenge:"Protect"Your"Data"At"The"Source
4
•The"perimeter"will"be"breached
•End"points"are"vulnerable
•Internal"users"are"a"risk
•Privileged"users"accounts"are"
data"wells"waiting"to"be"tapped

5. Challenge:"Simplify"Your"Compliance"Process
5
REGULATIONS
Monetary
Authority
of" Singapore
sox
IBJTRM
HITECH
PCI.DSS
EU"Data"
Protection"
Directive"
NCUA
748
FISMA
GLBA
HIPAA
Financial" Security"
Law"of"France
India’s"
Clause"49
BASEL" II
Best"Practices
Risk"
Assessment
Monitor"and"
audit
User"Rights"
Management
Attack"
Protection
Task"&"policy"specific"reporting

6. Data"Is"A"Company"Asset
Protecting"Data"Is"A"CompanyJwide"Necessity
IT Security DBA’s Risk'and'
audit

7. ©"2015"Imperva," Inc."All"rights"reserved.
Audit"Policy"vs."Database"Security"Policy
•Database"Audit
–Record"for"future"review
–Broad"scope
–Does"not"invoke"“action”
–Legal"record"of"events
•Database"Security
–Alert"in"real"time"on"suspicious"
behavior
–Block"in"real"time"against"obvious"
bad"behavior
–Implies"“action”
7

8. ©"2015"Imperva," Inc."All"rights"reserved.
Tools"vs."Solutions
•Tools"–perform"a"set"of"specific"tasks
•Solutions"–solve"a"business"problem
•Native"audit"is"a"logging"tool"with"no"security"or"policy"specific"capabilities
•SecureSphere"is"a"data"protection"and"audit"solution
•Improves"database"security
•Simplifies"compliance
8

9. ©"2015"Imperva," Inc."All"rights"reserved.
Things"For"You"To"Consider
•Architecture
–Monitoring"efficiency"
–Scale"DPA"to"DB"server"ratio
–DB"agent,"network"or"hybrid"
–Clustering"&"high"availability
•Deployment,"updates,"and"maintenance
–OutJofJtheJBox"expertise"&"content
–Agent"deployment/update"automation
–Upgrades/backwardJforward"compatibility
•Task"and"system"visibility
–Policy"specific"reports
–Centralized"management
–Role"based"functions"and"reports
•Database"identification"and"prioritization
–Data"discovery"
–Risk"classification
–User"rights"management
•Monitoring"Intelligence
–Effective"policy"management
–Data"enrichment
–Uniform"policy"enforcement
•Security"interlock
–User"tracking"and"dynamic"profiling
–Threat"correlation
–Alerts
–Blocking"(speed%and%flexibility)
9
Enterprise"Design"and"Deployment"Efficiency Audit,"Security,"and"Compliance"Functionality

10. ©"2015"Imperva," Inc."All"rights"reserved.
SecureSphere"Security"Capabilities
1.Inspects"more"–process"less
–Independent"highJperformance"monitoring"channels"
–Inspect"all"activity"for"security"purposes
–Audit"(log)"only"data"needed"for"compliance"reporting
2.Exchanges"and"correlates"information
–Id"and"track"users,"add"context,"verify"information
–WAF,"Ticketing"Systems,"LDAP,"FireEye,"and"SIEM"/"Splunk
3.Spots"and"stops"suspicious"activity
–Dynamic"profiling,"learns"automatically"over"time"
–Fine"tune"without"a"need"to"create"policies
–Alert,"Quarantine"and/or"Block
10

11. ©"2015"Imperva," Inc."All"rights"reserved.
SecureSphere"Compliance"Capabilities
1.Finds
2.Classifies"
3.Monitors"
4.Audits
5.Enforces"
6.Reports
11
Discover"rogue"
databases
Map"and"classify"
sensitive"
information
Default" and"
custom"policy"
trees
300+"Out"of"the"
box"policies
Automate" user"
rights"analysis"
and"verification
Id"and"track"
vulnerabilities
Simple" policy"and"
rule"creation
Data"enrichment
Activity"
monitoring
Privileged"user"
monitoring
PanJenterprise"
reporting
Investigate"and"
analyze

12. ©"2015"Imperva," Inc."All"rights"reserved.
SecureSphere"LeveragsYour"Other"Investments
•Limit"risk"with"FireEye
–Automatically"monitor"ALL"activity"or"restrict"data"access"of"compromised"hosts
•Improve"visibility"and"analysis"with"Splunk&"SIEM"solutions
–Holistic"analyze"consolidated"security"data"and"alerts
•Add"contextual"intelligence"with"LDAP"and"data"lookups
–User"verification"and"data"enrichment
•Enforce"change"management"polices"with"ticketing"systems
–Automatically"verify"and"log"existence"of"an"approved"change"request
•Track"users"from"web"app"to"database"activity"with"SecureSphere"WAF
–Correlate"user"activity"across"sessions"and"systems
12

13. ©"2015"Imperva," Inc."All"rights"reserved.
Smarter"Policy"Evaluation:"More"Context"=Better"Results"
PCI:'Shared"user"“sa”"just"ran"a"backup"of"all"customer" data"tables"at"noon"
•Is'there'a'change'control'ticket'number'for'that?
SOX:'DBuser"“wGa779a”"modified" 3"of"the"corporate"financial" tables"at"3"AM
•Who'is'DBuser'name'='wGa779a'(real'name,'role,'department,'email'address)?
HIPAA:'“FlorenceN”" accessed"the"Governor's"medical" history"last"week"
•What'type'of'Doctor/Nurse'is'she?
EventTime DBuser Operation Object
12:05:19 sa backup customerdb1
EventTime DBuser Operation Object
03:00:47 wGa779a update quarterrslt03
EventTime DBuser Operation Object TicketID
12:05:19 sa backup customerdb1 54321
EventTime DBuser DomainUser Department Operation Object
03:00:47 wGa779a hq\cjohnson Finance update quarterrslt03
EventTime DBuser Role Ward Operation Object
15:38:11 FlorenceN Nurse Maternity select carehistory
13

14. ©"2015"Imperva," Inc."All"rights"reserved.
Enterprise"fit"and"function
•Rapid,"flexible"deployment
•Less"hardware/VMs"required
•Predictable"performance"at"scale
•OutJofJtheJbox"integrations,"expertise"and"content
14
I"must"say,"I"REALLY"like"the"agent"update"process"you"guys"have!
Assistant%Vice%President,%IT,%a%Fortune%500%financial%holding%company,"Nov"5
th
,"2015

15. ©"2015"Imperva," Inc."All"rights"reserved.
Position"Yourself"For"The"Future
Only"27%"of"Big"Data"apps"
are"in"production
83%"of"Big"Data"apps"will"
require"some"form"of"
compliance
77%"No"audit"solution
Big'Data'Engines
30%"CAGR"IaaS/PaaSp"
$46B"on"database
64%"view"compliance"as"
barrier"to"cloud"adoption
No"offJdatabase"enterprise"
solution
Cloud'Adoption

16. ©"2015"Imperva," Inc."All"rights"reserved.
Position"Yourself"For"The"Future
16
Only"27%"of"Big"Data"apps"
are"in"production
83%"of"Big"Data"apps"will"
require"some"form"of"
compliance
77%"lack"an"audit"solution
30%"CAGR"IaaS/PaaSp"
$46B"on"database
64%"view"compliance"as"
barrier"to"cloud"adoption
No"offJdatabase"enterprise"
DAP"solution
Big'Data'Engines Cloud'Adoption
SecureSphere
Data
Protection
for
SecureSphere'for'
Big'Data

17. ©"2015"Imperva," Inc."All"rights"reserved.
Your"Action"Plan"for"Better"Data"Security
•Have"a"plan"and"know"desired"results"
•Know"and"classify"your"data
•Implement"a"universal"platform"and"policies
•Monitor"more"JJaudit"what"matters"
•Constantly"think"security"–TEST"IT
•Look"to"the"future"–scale,"cloud,"Big"Data
17

19. ©"2015"Imperva," Inc."All"rights"reserved.
Smarter"Policy"Evaluation:"More"Context"=Better"Results"
PCI:'Shared"user"“sa”"just"ran"a"backup"of"all"customer" data"tables"at"noon"
•Is'there'a'change'control'ticket'number'for'that?
SOX:'DBuser"“wGa779a”"modified" 3"of"the"corporate"financial" tables"at"3"AM
•Who'is'DBuser'name'='wGa779a'(real'name,'role,'department,'email'address)?
HIPAA:'“FlorenceN”" accessed"the"Governor's"medical" history"last"week"
•What'type'of'Doctor/Nurse'is'she?
EventTime DBuser Operation Object
12:05:19 sa backup customerdb1
EventTime DBuser Operation Object
03:00:47 wGa779a update quarterrslt03
EventTime DBuser Operation Object TicketID
12:05:19 sa backup customerdb1 54321
EventTime DBuser DomainUser Department Operation Object
03:00:47 wGa779a hq\cjohnson Finance update quarterrslt03
EventTime DBuser Role Ward Operation Object
15:38:11 FlorenceN Nurse Maternity select carehistory
19