Imperva SecureSphere - Database Activity Monitoring

Overview:

The SecureSphere Database Activity Monitoring delivers automated and scalable activity monitoring, auditing, and reporting for Oracle, MS-SQL, MySQL, IBM DB2 (including z/OS), Sybase, Informix and Teradata environments. SecureSphere tracks privileged user access, SQL transactions for forensics, prevents database leaks, and ensures audit integrity by establishing an independent audit trail of user activity. SecureSphere is deployed as a non-inline monitor (sniffer) on the network, while light-weight agents inspect local DBA traffic. Unlike native database logging, SecureSphere can track SQL queries and responses without degrading database performance.

As the most widely-used database monitoring solution, the SecureSphere Database Activity Monitoring has become the solution of choice for many of the world’s leading organizations. Offering server and sensitive data discovery, vulnerability assessment, activity monitoring, auditing and reporting, SecureSphere provides unmatched security, visibility, and compliance controls.

Benefits:

• Offers complete visibility and an independent audit trail of database activity
• Streamlines data collection, analysis, and compliance report creation
• Jumpstarts compliance initiatives by discovering and classifying sensitive data and assessing databases for vulnerabilities
• Documents security and compliance with powerful reporting engine
• Provides broadest options for network, agent, and agentless based database monitoring
• Supports large, distributed environments with a high-performance architecture and centralized management

Features:

• Detailed and Granular Auditing for Heterogeneous Environments – SecureSphere’s comprehensive audit trail tracks the "who, what, when, where and how" details for all database transactions on all platforms, including LUW and z/OS
   
• Automated Data Discovery, Classification and Vulnerability Assessment – SecureSphere discovers database servers and locates and classifies sensitive data; database assessments analyze databases for hundreds of vulnerabilities and configuration flaws.
   
• Material Variances of Profiled User Activity – Imperva’s unique Dynamic Profiling technology establishes a baseline of user activity and continuously updates the baseline profile over time; SecureSphere identifies material variances when users perform unexpected queries or violate access policies.
   
• Data Leak Prevention – SecureSphere inspects outbound traffic to identify and optionally audit leaks of sensitive data such as cardholder data and social security numbers.
   
• Separation of Duties Enforcement – SecureSphere’s audit mechanism is completely independent of the database being audited and it does not require DBA involvement for setup or maintenance. The audit log is stored separately in a tamper-proof repository and may be optionally encrypted or digitally signed.
   
• Low impact, High Performance, Zero Latency – By monitoring almost all SQL traffic at the network level and restricting Imperva’s light-weight agent to local DBA activity, SecureSphere offers unparalleled performance with no impact on existing applications or infrastructure.
   
• Enterprise-grade Centralized Management – Scaling to protect large, distributed data centers, the MX Management Server centralizes the configuration, monitoring and reporting of multiple appliances.
   
• Risk Management – Includes a powerful Risk Explorer to quickly identify and prioritize critical sensitive data and physical databases to audit.
   
• Powerful Reporting Framework – SecureSphere includes a flexible, graphical reporting engine that includes both pre-defined and fully-customizable reports. SecureSphere can also integrate with third party products such as SIEM and ticketing solutions.
   
• Automated Compliance Workflow – Compliance reports may be scheduled and distributed across the organization; SecureSphere can record when key stakeholders review reports or define followed tasks.

Solutions:

The SecureSphere Database Activity Monitoring (DAM) solution is designed to provide the industry’s best automated auditing and security for critical database platforms. It helps organizations gain visibility into their database activity and understand their risk posture through discovery and assessments, continuous auditing, and effective measurements.

 

Discovery and Vulnerability Management

Database Discovery and Classification
SecureSphere ensures that organizations can prioritize and protect all sensitive data. Network based discovery of database servers throughout the network ensures awareness. Classifying databases based on the data types they contain helps organizations map and prioritize the discovered servers and fundamentally understand which servers are within the scope of a regulatory compliance project.

Comprehensive Vulnerability Assessment
SecureSphere includes a full set of platform assessment tests, RDBMS vulnerabilities and best practices to help organizations remediate and control the configuration of their database environments and implement an overall vulnerability management strategy.

The assessments are kept up-to-date with the latest research from the Imperva Application Defense Center (ADC) research team.

Intelligent Behavioral Assessments
Behavioral assessment delivers unique visibility into how users and applications are actually accessing and manipulating database data. SecureSphere builds a comprehensive usage profile for analysis and reporting that shows activity details like time/date, source/destination, user, client application, and can be used to spot abnormal activity.

Automated Auditing and Security

SecureSphere includes a complete set of predefined audit and security policies which can be quickly implemented for monitoring any database environment. These policies are based on ‘Black-list’ and ‘White-list’ security modules which are continuously updated through Imperva’s patent pending Dynamic Profiling Technology and updated research conducted by the Imperva ADC.

The Dynamic Profiling technology automatically detects and incorporates valid changes over time, and relieves administrators from the need to manually create and update tedious white lists that contain hundreds and thousands of objects, users and SQL queries.

Continuous Audits and Analysis of all Database Traffic

Granular auditing and continuous monitoring of all database operations in real-time provides organizations with a detailed audit trail that shows the ‘Who, What, When, Where and How’ of each transaction. SecureSphere captures all database activity including DML, DDL and DCL activity, read-only activity (SELECTs), changes made to stored procedures, triggers and database objects, as well as SQL errors and database login activity. SecureSphere also monitors (and optionally audits) the database response to ensure there is no leakage of sensitive data.

Managing Security and Change
SecureSphere monitors database activity in real time and looks for various database attacks at the OS, protocol level, and SQL level. Granular row-level change auditing enables accurate alerts on fraudulent activity, database changes, and attacks – sending real-time alerts, assigning followed tasks, and ensuring change control.

Independent Monitoring and Auditing
As an independent monitoring solution, SecureSphere does not require enablement of native auditing tools, nor does it rely on the DBA for implementation and maintenance. SecureSphere leverages gateway appliances to monitor network traffic, and light-weight SecureSphere agents to capture local activity and eliminate blind spots. This non-intrusive hybrid architecture ensures audit independence and separation of duties.

Tamper-Proof Audit Trail
SecureSphere captures the detailed audit trail in an external, secured and hardened repository which can be accessed through read-only views. The repository enforces a role based access mechanism (RBAC) for administrative and security usage. To ensure the integrity of the audit trail it can also be encrypted.

Streamline Compliance Efforts

Interactive Audit Analytics
Complete visibility into audited activities is provided through interactive audit analytics, which enables non-technical database auditors to analyze, correlate, and view database activity from virtually any angle with just a few mouse clicks, enabling easy identification of trends and patterns that may conceal security risks or compliance problems.

Best-in-Class Reporting
SecureSphere provides easy reporting on audited events with predefined graphical reports that help measure risk and address regulatory requirements. Specific reports are designed for demonstrating compliance with SOX, PCI, and other data privacy laws. Scheduling automated reports, sending the results in PDF or HTML formats, and integration with SIEM, ticketing systems and other 3rd party solutions streamlines business processes.

Risk Management for Databases
SecureSphere significantly reduces the efforts required to effectively and efficiently manage risk to data. Enterprise risk management dashboards and drill-down views help organizations establish mitigating controls to prevent data loss and information leaks, reducing the risk of unauthorized access and fraudulent activity.

Flexible Deployments, Low TCO

Flexible Deployment Modes: Network, Agent, Native Audit, or Hybrid
SecureSphere offers the most flexible deployment options, offering non-intrusive network monitoring, lightweight agent monitoring, native audit collection, or a hybrid mix. This enables organizations to deploy whatever mix fits their unique topology and business needs.

Performance and Scalability
Unmatched by any other DAM solution, SecureSphere provides fast processing and complete audit capabilities that can easily scale to support any environment – from SMBs to large Enterprise.

Centralized Management
SecureSphere offers centralized management for SecureSphere gateways. This enables better efficiency and effectiveness in large-scale SecureSphere deployments. And support for hierarchical policy management and administrations supports even the largest organizations.

 

Features and Appliance Specifications:

 

¹ Database agents only included with SecureSphere Database Activity Monitoring, Database Firewall, and Data Security Suite.
² Database assessments only included with Discovery and Assessment Server, Database Activity Monitoring, Database Firewall, and Data Security Suite.

View Demo:

 

Documentation:

Download the Imperva SecureSphere Database Activity Monitoring Datasheet (PDF).