Application Security Inc.'s New DbProtect Active Discovery Finds Forgotten And Previously Unknown Databases

PRESS RELEASE

NEW YORK, February 15, 2012 Application Security, Inc. (AppSecInc) the leading provider of database security solutions for the enterprise, today declared that organizations can no longer afford to guess or assume that they have their database inventory under control. Based on the premise that you cannot secure what you don’t know you have, AppSecInc offers DbProtect Active Discovery to protect against the risks associated with forgotten, unknown, or unauthorized databases. Built upon its unique intellectual property, DbProtect Active Discovery provides companies with a simple to use, automated way of finding all databases listening on the network.

Locating all databases deployed within an enterprise and accounting for all sensitive data distributed across those databases is an essential component of an effective database security process control program. Over time, enterprises can lose track of their database inventory and become populated with forgotten and unauthorized databases. Often times, these “rogue” databases are not properly configured or secured. As a result, they create a security risk by providing attackers with an easy target that can be used to gain access to other databases containing sensitive data.

“Most organizations believe that they have a firm grasp on their database inventory, but almost every time we have scanned a network using our Active Discovery technology, we have turned up far more databases than the prospect or customer believed were present,” said Josh Shaul, Chief Technology Officer, AppSecInc. “The harsh reality is that database inventories at nearly all organizations are not up to date and it is an eye-opening revelation when organizations see the results of our scans.”

We Speak Database

Powered by a proprietary scanning methodology, DbProtect Active Discovery uses database protocol-based validation, rather than relying solely on simple port-based detection. The use of vendor-specific database language is the only way to ensure a completely accurate inventory of databases on the network.

This approach enables Active Discovery to:

Find all databases – whether they are communicating over the network or not.

Find databases on any port, not just default ports.

Initiate communication in vendor-specific protocols to confirm that a database has been discovered and identify the database platform.

By employing this unique set of capabilities, Active Discovery identifies every database by hostname, IP address, port, database type and version, and eliminates the risk of any database lingering unknown and posing a potential security risk.

Be Active, Not Passive

DbProtect Active Discovery employs active scanners which probe all ports on the network, not just database ports, ensuring that they locate and identify all databases. Passive database discovery solutions work by looking for SQL commands between applications and databases at various points on the network. This approach is severely limited in scope as it fails to identify databases that are not communicating over the network. Additionally, any database traffic that is not routed across the points in the network that are being monitored will not be discovered – and it’s impossible to monitor every point on the network all the time. The end result is an incomplete database inventory and a false sense of security generated by the passive database discovery approach.

“While designed as simple to use, DbProtect Active Discovery is based on very complex intellectual property created specifically to provide the high level of accuracy necessary to properly establish and maintain a complete database inventory and corresponding data security levels,” added Shaul.

“Companies need to be fully aware of the severe limitations and security challenges introduced by taking a passive approach to finding databases. It’s the most basic of all security principles. You simply cannot secure what you don’t know you have.”

DbProtect Active Discovery is generally available and included as part of the DbProtect 6.3 platform. For further information, please contact an AppSecInc sales representative at 1-866-9APPSEC or visit: http://www.appsecinc.com/products/dbprotect/.

About Application Security, Inc. AppSecInc is a pioneer and leading provider of database security solutions for the enterprise. By providing strategic and scalable software-only solutions – AppDetectivePro for auditors and IT advisors, and DbProtect for the enterprise – AppSecInc supports the database security lifecycle for some of the most complex and demanding environments in the world across more than 1,300 active commercial and government customers.