New Report Helps Enterprises Choose Their Own DAM Products

[Excerpted from "Database Activity Monitoring: Emerging Technology Keeps Tabs On Assets," a new report published today in Dark Reading's Database Security Tech Center.]

When it comes to databases, there's one thing that all users agree on: a single breach can be devastating. One look at the security headlines will tell you that no company can afford a database leak.

One of the most promising technologies for security pros who are struggling to stay on top of this concern is database activity monitoring, or DAM. These systems enable organizations to monitor database events in real-time and quickly respond to unauthorized activity.

Some DAM products provide features for privileged-user monitoring and basic database auditing, two areas that have historically been underserved. Need more? The use of DAM technology is starting to be considered an essential control when demonstrating compliance with industry regulations and standards that require regular review of logs -- a category that includes PCI DSS, HIPAA, the Gramm-Leach-Bliley Act, FISMA, and Sarbanes-Oxley.

These products are still expensive; appliances run $25,000 to $50,000 per device, while agent-based offerings cost $5,000 to $25,000 per database. There are tough architectural decisions to be made, especially for distributed enterprises. Expect some turf warfare.

But because databases are increasingly targets for attackers, and few of us are willing to encrypt them, a DAM system might just be worth the investment.

In a nutshell, most DAM products monitor all SQL activity in real time across multiple database platforms and generate alerts based on policy violations. These systems also have the ability to aggregate -- and, to some degree, correlate -- activity from multiple heterogeneous database products, including Microsoft SQL Server and Oracle.

Some products also provide the additional benefit of monitoring and securely storing records of activity outside the target databases, which can come in handy if the systems housing these databases are ever compromised.

There are various technical approaches that enable DAM products to achieve these goals, but systems can be grouped into three primary categories: network monitoring, remote monitoring and local agent monitoring. Network monitoring products are typically delivered via appliances, whereas local agent monitoring DAM systems are software-based. For companies that need to do remote monitoring, native auditing is turned on for the target database, and the resulting activity log data is sent to an external appliance.

Choosing the best model is a matter of weighing the pros and cons of each approach and evaluating the database environment that you're looking to protect.

This calculation depends on your specific environment and overall goals. Using a combined approach to database monitoring provides the best coverage, but the involved nature of that type of deployment can be a scary proposition for some IT teams.

Organizations should first decide which threats they're the most concerned about. Do you think DBA/insider abuse is more likely than external manipulation of an application to do database dumping? Then catalog operational restrictions and dust off the debate over how comfortable you are with proactive blocking mechanisms.

DAM deployments require cooperation among multiple groups, and the dependencies on various IT specialties should not be underestimated. For example, for inline products, the network team will have to design and provision span ports on critical switches -- ports that, in some organizations, are in short supply.

With agent-based products, both system administrators and DBAs will need to be involved, as you'll be introducing yet another "moving part" on systems for which they are responsible. The larger the organization and more extensive the DAM deployment, the more people you'll need to bring to the table. CIOs should start getting those parties lined up early.

For more detailed insight on how to choose a choose a DAM product and how to deploy it, download the full report here.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.