There are several tools that can help assess risks and vulnerabilities in critical systems, such as databases, not only during development, but also when they are online. Application Security Inc. (http://www.appsecinc.com), for example, produces both AppDetective, which discovers database applications within your infrastructure and assesses their security strength, and AppRadar, a real-time database intrusion detection and security...
auditing solution. It can detect and flag events defined by user activity. Both of these products support Oracle databases. Another product for Oracle is NGSSquirrel by NGS Software (http://www.ngssoftware.com/). This is a vulnerability assessment scanner specifically developed to scan Oracle database servers. If you need to support SAP and PeopleSoft applications, AppSentry by Integrigy Corporation (http://www.integrigy.com/), has security audits and checks written specifically for both applications, as well as Oracle database. This tool can validate and audit the security of the entire application technology stack, from operating system to application layer.
In order for any security tool to detect suspicious or unusual behavior within your network or applications, you must first create a security policy that defines allowed and expected user behavior. Security policies and procedures that are documented, well-known and enforced play a vital role in identifying signs of intrusion or attack. If you're unsure of what to document, here are a few things to record:
- Document the types of threats or events that indicate possible signs of attack, such as the unauthorized use of a system to process, store or transmit data.
- Document the data you need to collect to be able to catch unwanted behavior.
- Document where, when and how you will collect the data.
Remember that it doesn't matter what tools you use to test and monitor your network and applications, you must regularly review the information they produce for signs of unknown or suspicious behavior.
Dig deeper on Web Application Security
Related Q&A from Michael Cobb
Security expert Michael Cobb explains what Open Authorization or OAuth 2.0 is, its pros and cons, and how it is different from bring your own ...continue reading
While the fundamentals of securing an e-commerce website haven't changed in a few years, there are new threat vectors and security risks to be aware ...continue reading
There are apps available that encrypt voice communications on smartphones and BYO devices, but are they really worth the investment? Expert Michael ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.