GOLD | Symantec Database Security
Price: Appliance, $10,000; software, $5,000 per CPU for Windows, $10,000 for Unix
Symantec has been quick to assert itself in the growing database security market, with a new auditing and monitoring product that resonates with its customers, earning a Readers' Choice gold medal.
Respondents gave Symantec Database Security high marks where it counts, overwhelmingly rating it excellent or good in protecting their data. Almost as important, they gave it high marks for ease of installation, configuration and administration, a major factor as organizations struggle to integrate new security tools without additional management resources. The product passively sniffs traffic and stores audit data offline, causing zero impact on database performance or availability.
"There's no overhead on production servers--that's a key for us," says Ayad Shammout, lead technical database administrator for CareGroup Healthcare System, which manages four Boston-area hospitals. "And we don't want to deploy agents. They're a headache to manage."
Users also like the product's scalability and its minimal impact on existing infrastructure.
Symantec Database Security sniffs database traffic, detecting anomalous behavior from insiders or external sources, which may be malicious or simply authorized personnel failing to follow procedure. It does this by running in learning mode to build a profile of normal behaviors, allowing managers to distinguish between unauthorized and acceptable activity.
The product continuously monitors database activity, firing off alerts and enabling security managers to quickly investigate and mitigate issues. Organizations can use it in a variety of ways: to protect confidential data, detect fraud activity, monitor and confirm change management procedures and prepare comprehensive reports for auditors.
While the IT/security giant has been drawing attention for a wave of acquisitions, Database Security is a homegrown product, developed by Symantec's Advanced Research Group, which is "like a small startup within Symantec looking for new opportunities in emerging markets," says Gautam Vij, senior product manager, Symantec Database Security. Symantec has spent close to four years in development, he says.
Although Database Security was initially rolled out as an appliance, Symantec, consistent with its new strategy, will continue to develop and market it as software, working with OEMs.
SILVER | AppDetective
Price: $900 annually per database
It's a safe bet your critical databases are vulnerable to attack, and AppDetective, one of a handful of specialized vulnerability scanners on the market, performs its job so well that readers voted it silver medalist in the database security category. AppDetective, available as a standalone product or as part of the DbProtect suite with AppRadar, a database monitoring tool, scored high among readers for its integration and compatibility with existing infrastructure, an important point for vulnerability scanners, which are often seen as intrusive, even disruptive. Readers also liked AppDetective's reporting and alerting capabilities. The network-based scanner simulates attacks, performing penetration testing to discover vulnerabilities and misconfigurations. It can also perform security audits, determining vulnerability to internal misuse.
BRONZE | SecureSphere Database Security Gateway
Price: Starts at $45,000
This database monitoring, auditing and protection appliance drew strong approval from its customers, rating very well across the board to earn the bronze. SecureSphere scored well in every criteria: granularity of access controls and integration with existing infrastructure, scalability and management, data protection, customer support and alerting and reporting. Respondents said they're getting their money's worth. SecureSphere assesses databases by profiling normal behavior in learning mode, and detects anomalous behavior based on that, as well as built-in and custom policies. It offers an enforcement capability, giving organizations the option to automatically block select unauthorized activities. In addition, its integrated IPS protects against attacks on known vulnerabilities in database platforms and operating systems.
In the trenches
The heart of the business
Databases contain the lifeblood of your business; preventing data breaches and satisfying demanding auditors can be a resource-draining exercise in frustration without the right tools.
Security is at the core of all operations when you're in the business of producing enriched uranium for commercial power plants, but as a publicly traded company, USEC faces the same challenges as other corporations satisfying SOX requirements for strong controls over its financial databases.
"We had to monitor access to privileged accounts, primarily for financial systems," says David Vordick, USEC's CIO. "We had to be sure of our internal controls for privileged users, primarily DBAs, to be sure they weren't misusing that right.
"Our SOX audit has gone well," says Vordick, who has been using Guardium's SQL Guard database monitoring and auditing tools for about 18 months. "The technology was a key part. The solution is identified in our internal controls, and we had no problems."
Regulatory pressure is driving many corporations to deploy database security tools, and they are keenly aware that an embarrassing breach of sensitive non-public information can severely damage their business.
"We have key databases with phone records, personal information and credit card numbers used by call centers," says Christopher Knauer, vice president of information security for Vonage, which recently deployed RippleTech's Informant database monitoring product. Notably, information security falls under the legal department at the VoIP phone service provider. "At lower levels, access is very restricted, but we have concern at higher levels of access--we want to know exactly what they are doing."
Database security is not for the faint of heart. Even with the best processes and policies in place, organizations are hard-pressed to wade through mountains of logs or crawl through databases without the right tools to verify security controls and expose vulnerabilities, access violations and fraud.
"Our system has 35 schools, large and small. At small schools, the DBA may also be the programmer and the Web master," says Scott Woodison, IT audit manager for the board of regents for the University System of Georgia. Using Application Security's AppDetective database vulnerability assessment tool helps Woodison to act as a roving pen tester throughout the system.
"We had a huge logging problem, devoting an FTE to manually review gigabytes of daily logs and produce reports," says the security manager for a mid-market financial institution. "Auditors were not impressed with manual auditing of 20 to 30 databases and less than thrilled with the accuracy of the human brain to parse through millions of lines from logs."
The financial institution bought Imperva's Secure-Sphere tools to help bring the process under control.