Guardium – Real-Time Database Protection and Compliance

Real-Time Prevention, Without Impacting Your Business
Guardium’s real-time monitoring technology uses both policy-based controls and anomaly detection to prevent unauthorized activities by potential hackers, privileged insiders, and end-users of enterprise applications such as Oracle EBS, PeopleSoft, and SAP.

At the same time, our solution consolidates and normalizes audit information from disparate systems into a centralized audit repository. This audit data warehouse can then be used for enterprise-wide compliance auditing and reporting, correlation, and forensics by leveraging Guardium’s integrated suite of applications and data mining tools.

The Guardium solution continuously tracks all DBMS traffic at the network level and on database servers themselves, across all major DBMS platforms, OS platforms, and applications. By doing so, it provides a full set of detective controls with 100 percent visibility into all database activities, without impacting the performance of business-critical applications and databases.

Unique to the industry, we also provide a rich set of preventive policy-based actions for implementing granular access controls to sensitive data. These controls range from real-time alerts to blocking unauthorized local-access connections to customizable policy actions such as automated lock-outs and VPN port shut-downs.

Limitations of Traditional Security Solutions
Traditional security technologies are insufficient to address key requirements because they lack embedded knowledge about database protocols and structures:

Perimeter and IDS/IPS defenses lack specialized awareness of database protocols and activity patterns
Database encryption requires major changes to applications and databases, and does not protect against privileged users or hackers who hijack application servers to gain access to back-end databases
Data Leak Prevention (DLP) technologies fail to protect enterprise data in the data center itself. Instead they catch sensitive data as it leaves end-points via USB devices or the network perimeter via IM or email
Native DBMS logging utilities either impose significant performance overhead or fail to capture sufficient information (such as read operations). In addition, they do not provide real-time protection or support separation of duties, and cannot identify end-users who access databases via multi-tier enterprise applications
Security Information and Event Management (SIEM) systems rely on native DBMS log data rather than collect database logs on their own. They also lack advanced, database-focused analytics

Full Visibility and Understanding
A visual access map allows you to quickly identify unauthorized users and applications with a graphical representation of all database servers, clients, subnets, and applications. Interactive drill-downs enable quick understanding of the “who, what, when, where, and how” of all database transactions.