Report: No Magic Bullet For Database, Server Security

There's no quick fix for securing data on databases and servers, and new tools that can prevent attacks on these systems are a long way off, according to a new report.

For the near term, encryption will remain the most popular defense for locking down data on databases and servers, while database monitoring and Web filtering will continue to be pervasive tools for breach detection, according to Forrester Research's new report.

Protecting data on servers and databases has never been easy, and doing so has become only more challenging with mobile users, cloud computing, and an unstable employment climate, says Jonathan Penn, vice president of tech industry strategy/security at Forrester, who co-authored the report with Forrester's Andrew Jaquith. "Over the foreseeable planning horizon, help for CISOs will not arrive in the form of a miracle tonic. Forrester does not foresee that a miraculous technology -- for example, error-free data discovery and classification -- will emerge to save the day," he says.

Instead, existing "brute force" tools, like encryption and data masking, will continue to emerge as the key tools to keeping data under wraps, while database monitoring and Web application filtering will provide insight into breaches. "While prevention may not prove practical in all cases, detection will be," Penn says. Compliance and contractual requirements will keep organizations buying those technologies, which "give them visibility to theft, corruption, and abuse as it happens," he adds.

The Payment Card Industry Data Security Standard (PCI DSS) and states' data breach disclosure laws are driving enterprises to adopt these data security technologies.

Meanwhile, enterprises aren't ready to deploy data discovery and classification technologies, Forrester says. The data discovery market won't mature for several years, Forrester says, even though the concept of crawling an enterprise network to find where the sensitive data lives should be a no-brainer by now in this age of big search engines.

Data classification, meanwhile, won't hit its stride until about 2014, when security-specific data classification tools will blend with knowledge management and electronic records classification technologies.

"Classification is a challenge because many different groups are looking at [it] from different perspectives and not coordinating their efforts," Penn says. The security, storage management, legal departments, and information/knowledge management groups all need these tools, but they won't make it into the organization until security/risk management and information/knowledge management team, he says.

"These groups will realize that by aligning their interests, they can be more effective, consolidate vendors, and cut costs," Penn says.

Plus, data classification tools, such as data protection, archiving/retention, e-discovery, and knowledge management, are very focused, he says. "For example, e-discovery classification tools have far less sophistication in their content analysis capabilities than the DLP [data leakage protection] tools security people are employing," he says. "Classification needs to be done in the infrastructure, across areas, so that a file managed by the archive system is classified the same way that a rights management [system] would classify it when deciding who can look at it, and the same way a DLP product would classify it when deciding whether a user can send it off to a USB or by email."

Forrester's report, "TechRadar For Vendor Strategy Professionals: Database And Server Data Security, Q2 2009," is geared for vendors looking at how to plan their strategies in this space.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.