printer friendly version

Protecting database information

Databases store a critical amount of information and often become the source of the largest data breaches. Database Monitor protects information in databases and shows the ways in which users work with them in order to detect a threat and prevent an incident.

The system is a DAM (Database Activity Monitoring) solution and conducts automated monitoring and auditing of operations on databases, allowing a specialist to see who accesses a database and why, and which information gets exposed or used, changed and removed. The software analyses the information which is exported from a database and detects an employee attempt to download, edit or delete confidential corporate details, such as tax reporting or client information, etc.

Database Monitor detects all the requests to databases from business applications or privileged users who access DBMS directly – for example, system administrators who have rights to manage databases. This allows a company to monitor their activity and raise an alert on violations. Besides, the function helps discover spyware which accesses databases to steal data. Database Monitor also controls DBMS efficiency – the software creates a report based on the speed of request processing and errors during request execution. The general statistics on database status is available on a user-friendly dashboard.

“DAM solutions are needed to detect anomalous events in databases promptly. We went further and added investigating functions to the monitoring in order to fully protect databases from insider threats. Any request to databases can be found manually or automatically in Database Monitor: by phrase, by user, by computer or IP address from which it was sent. In the same way, the system analyses what information a database sends in response and allows users to search by the content of the responses.

“For example, the cases when passport numbers are exported from a database can be found with the help of the search by a typical sequence of digits. Thanks to this a customer can control all the dangerous events whether it is an export of confidential data or a large amount of requests from one user. The system will save all the relevant details and alert to the possible incident,” comments Alexey Parfentiev, leading analyst at SearchInform.

The solution can be integrated with other information security and risk management systems, including DLP, file auditing and SIEM systems. When using Database Monitor together with other SearchInform products, a specialist can control security events at each level of the IT infrastructure within one interface.

Share this article:

Further reading: