Assess & Harden
.

Vulnerability, Configuration and Behavioral Assessment
Guardium’s database security assessment scans your entire database infrastructure for vulnerabilities and provides an ongoing evaluation of your database security posture, using both real-time and historical data.  The assessment provides a comprehensive library of preconfigured tests based on industry best practices, such as the DOD’s Database Security Technical Implementation Guide (STIG).

These tests also pinpoint DBMS–specific vulnerabilities and are updated on a quarterly basis via Guardium’s subscription service.  You can also define custom tests to match specific requirements.

Guardium’s assessment module also flags compliance-related vulnerabilities such as unauthorized access to reserved Oracle EBS and SAP tables for compliance with Sarbanes-Oxley (SOX) and the Payment Card Industry Data Security Standard (PCI-DSS).

Assessments are grouped into two categories:

  • Vulnerability and configuration tests check for vulnerabilities such as missing patches, weak passwords, misconfigured privileges and default accounts
  • Behavioral tests identify vulnerabilities based on the ways in which databases are being accessed and manipulated —such as an excessive number of failed logins, clients executing administrative commands, or after-hours logins—by monitoring all database traffic in real-time

In addition to producing detailed reports with drill-down capabilities, the assessment module generates a security health report card with weighted metrics (based on best practices) and recommends concrete action plans to strengthen database security.


Multiple Assessment Technologies, Without Impacting Uptime or Performance
Guardium’s vulnerability assessment technology combines three essential detection methods recommended by industry experts, providing comprehensive coverage for a wide range of vulnerabilities and threats. The three methods are:

  • Agent-based – Lightweight agents installed on each database server are used to determine aspects that cannot be determined remotely, such as the status of database configuration files and local access to sensitive data by privileged users (via non-TCP protocols such as shared memory, named pipes, Oracle BEQ and Sybase TLI)
  • Passive Network Monitoring – The system discovers vulnerabilities and dangerous behavior by observing all database transactions at the network level, such as calls to unpatched procedures from unauthorized applications, access to sensitive data from remote locations or usage of shared administration accounts and service IDs
  • Scanning – The system assesses vulnerabilities such as misconfigured account controls and insecure passwords by interrogating the database server over the network through credentialed access
Best of all, Guardium’s vulnerability assessment technology provides complete assessment coverage without impacting the performance or stability of critical production systems.  The system does not run intrusive exploits that can crash systems by imitating the behavior of an attacker, and it does not rely on traditional database logs or native auditing features that can introduce additional overhead.


Configuration Lock-Down and Change Tracking
Once you have implemented the recommended actions generated by the vulnerability assessment, you can now establish a secured configuration baseline. Using Guardium’s change auditing system (CAS), you can monitor any changes to this baseline, and ensure that changes are not made outside of your authorized change control policies and processes.

With Guardium’s CAS, organizations can track all changes to:

  • Security and access control objects such as users, roles, and permissions
  • Database structures such as tables, triggers, and stored procedures. The CAS can also detect accidental deletions or insertions of critical tables that can impact data governance
  • Critical data values such as data that affects the integrity of financial transactions
  • Database configuration objects that can affect security posture such as OS and database configuration files (e.g., sqlnet.ora), environment/registry variables and executables such as shell scripts, Java and XML programs