Imperva SecureSphere - Database Firewall

Overview:

The award-winning SecureSphere Database Firewall monitors and proactively protects databases from internal abuse, database attacks, and unauthorized activity. The Database Firewall delivers a powerful platform to monitor, audit, and protect Oracle, MS-SQL, IBM DB2, Sybase, Informix and Teradata databases without impacting database performance and without requiring application or network changes. It can be deployed in front of database servers to directly protect them from attacks and data leakage. SecureSphere appliances and agents audit SQL transactions for forensics, prevent database leaks, and ensure data integrity by establishing an independent audit trail of user activity.

The SecureSphere Database Firewall is the only solution available that can directly protect databases from potential attacks. With pre-built security policies, audit rules, and reports for PCI, SOX, HIPAA, and enterprise applications, SecureSphere customers can protect their most valuable database resources.

Benefits:

• Accurately monitors and actively protects mission-critical database servers
• Offers complete visibility and independent audit trail of database activity
• Automates data collection, analysis, policy enforcement, and reports
• Demonstrates security and compliance with best-in-class monitoring and reporting
• Provides broadest options for network, agent, and agentless based database monitoring
• Unifies management and monitoring of multiple gateways through centralized MX Management Server

Features:

• Total Database Protection and Accurate Policy Enforcement – The SecureSphere Database Firewall blocks unauthorized activities and sophisticated attacks before they reach the database.
   
• Virtual Patching solution – Protect mission critical databases with virtual patching when vendor-supplied patches cannot be deployed. Virtual patching does not require any changes to the database or applications.
   
• Automated Data Discovery, Classification and Vulnerability Assessment – SecureSphere discovers database servers and locates and classifies sensitive data; database assessments analyze databases for hundreds of vulnerabilities and configuration flaws.
   
• Detailed and Granular Auditing for Heterogeneous Environments – unified auditing provides the: “who, what, when, where and how” details for all major database platforms.
   
• Data Leak Prevention – SecureSphere inspects outbound traffic to identify and optionally audit or block leaks of sensitive data such as cardholder data and social security numbers.
   
• Low impact, High performance, Zero latency – By monitoring almost all SQL traffic at the network level and restricting Imperva’s light-weight agent to local DBA activity, SecureSphere offers unparalleled performance with no impact on existing applications or infrastructure.
   
• Enterprise-grade Centralized Management – Scaling to protect large, distributed data centers, the MX Management Server centralizes the configuration, monitoring and reporting of multiple appliances.
   
• Powerful Reporting framework – SecureSphere includes a flexible, graphical reporting engine that includes both pre-defined and fully-customizable reports. SecureSphere can also integrate with third party products such as SIEM and ticketing solutions.
   
• Risk Management – Includes a powerful Risk Explorer to quickly identify and prioritize critical sensitive data and physical databases to protect.
   
• Automated Compliance Workflow – Compliance reports may be scheduled and distributed across the organization; SecureSphere can record when key stakeholders review reports or define followed tasks.

Solutions:

The SecureSphere Database Firewall (DBF) solution is designed to provide the industry’s best automated protection for critical database platforms. Through realtime activity blocking it controls access to databases and protects against fraud, abuse, and external attacks. Providing complete visibility into database activity enables organizations to implement a complete database security and compliance solution.

Discovery and Vulnerability Management

Database Discovery and Classification
SecureSphere ensures that organizations can prioritize and protect all sensitive data. Network based discovery of database servers throughout the network ensures awareness. Classifying Databases based on the data types they contain helps organizations map and prioritize the discovered servers, and understand which servers are within the scope of a regulatory compliance project and may require more stringent controls.

Comprehensive Vulnerability Assessment
SecureSphere includes a full set of platform assessment tests, RDBMS vulnerabilities and best practices. It helps organizations remediate and control the configuration of their database and implement an overall vulnerability management strategy.

The assessment tests are kept up-to-date with the latest research from the Imperva Application Defense Center (ADC) research team. From the Vulnerability Workbench users can apply Virtual Patching to block exploitation attempts.

Intelligent Behavioral Assessments
Behavioral assessments provide visibility into the ways users and application access and manipulate data stored in databases. By capturing activity details like the user, date and time of the event, source, destination and the tools/ applications used, and building a comprehensive profile, SecureSphere can provide detailed analysis, alert and optionally block abnormal activity.

Database Activity Monitoring

Automatic Auditing
SecureSphere includes a complete set of predefined security and audit policies which can be quickly implemented for protecting any database environment. These policies are based on ‘Black-list’ and ‘White-list’ security modules which are continuously updated: The ‘Black List’ is updated by the Imperva ADC research group, the ‘White List’ is updated by Imperva’s patent pending Dynamic Profiling technology, which automatically detects and incorporates valid changes over time, and relieves administrators from the need to manually create and update tedious white lists that contain hundreds and thousands of database objects, users and SQL queries.

Independent Monitoring and Auditing
As an independent security solution, SecureSphere does not require enablement of native auditing tools, nor does it rely on the DBA for implementation and maintenance. SecureSphere leverages gateway appliances to monitor network traffic, and light-weight SecureSphere agents to capture local activity and eliminate blind spots.

Tamper-Proof Audit Trail
SecureSphere captures the detailed audit trail that shows the ‘Who, What, When, Where and How’ of each transaction. The audit trail is stored in an external, secured and hardened repository which can be accessed through read-only views. To ensure the integrity of the audit trail it can also be signed or encrypted.

 

Real-Time Database Protection

Blocking Unauthorized Activity
Continuous real-time monitoring and analysis of all database operations allows SecureSphere to respond quickly and block unauthorized activities. SecureSphere monitors network and direct access to databases and captures all database

Activity including DML, DDL and DCL activity, read-only activity (SELECTs), changes made to stored procedures, triggers and database objects, as well as SQL Errors and database login activity. SecureSphere also monitors (and optionally audits) the database response to ensure there is no leakage of sensitive data.

Attack Blocking and Virtual Patching
As SecureSphere monitors live database activity it looks for various database attacks at the OS and protocol level as well as the SQL activity level to provide accurate real-time protection. Unauthorized change, fraudulent activity, and database attacks can be blocked on the network before reaching the protected system, or on the system itself.

Virtual Patching helps transparently protect vulnerable systems which can’t be patched or modified.

Streamline Compliance Efforts

Interactive Audit Analytics
Complete visibility into audited activities is provided through Interactive Audit Analytics, which enables non technical database auditors to analyze, correlate, and view database activity from virtually any angle with just a few mouse clicks, enabling easy identification of trends and patterns that may conceal security risks or compliance problems.

Best-in-Class Reporting
SecureSphere provides easy reporting on monitored events with predefined graphical reports that help measure risk and address regulatory requirements. Specific reports are designed for demonstrating compliance with SOX, PCI, and other data privacy laws. Scheduling automated reports, sending the results in PDF or HTML formats, and integration with SIEM, ticketing systems, and other 3rd party solutions streamlines business processes.

Risk Management for Databases

SecureSphere significantly reduces the efforts required to effectively and efficiently manage risk to data. Dashboards and drill-down views help organizations establish mitigating controls to prevent data loss and information leaks, reducing the risk of unauthorized access and fraudulent activity.

Flexible Deployments, Low TCO

Flexible Deployment Modes: Network, Agent, Native Audit, or Hybrid
SecureSphere offers the most flexible deployment options, offering non-intrusive network monitoring, lightweight agent monitoring, native audit collection, or a hybrid mix. This enables organizations to deploy whatever mix fits their unique topology and business needs.

Performance and Scalability
Unmatched by any other DAM solution, SecureSphere provides fast processing and complete audit capabilities that can easily scale to support any environment – from SMBs to large Enterprise.

Centralized Management
SecureSphere offers centralized management for SecureSphere gateways. This enables better efficiency and effectiveness in large-scale SecureSphere deployments. And support for hierarchical policy management and administrations supports even the largest organizations.

Features and Appliance Specifications:

 

¹ Database agents only included with SecureSphere Database Activity Monitoring, Database Firewall, and Data Security Suite.
² Database assessments only included with Discovery and Assessment Server, Database Activity Monitoring, Database Firewall, and Data Security Suite.

View Demo:

 

Documentation:

Download the Imperva SecureSphere Database Firewall Datasheet (PDF).