A Guide To Practical Database Monitoring

A look at what database activity monitoring can and cant do, and some recommendations on how to implement the best system for your organization

[Excerpted from A Guide to Practical Database Monitoring, a new, free report posted this week on Dark Readings
Database Security Tech Center
.]
Database activity monitoring, a form of application monitoring, examines how applications use data and database resources to fulfill user requests. DAM captures and records database events -- which, at minimum, includes all SQL activity -- in real time or near real time.
DAM is focused on the database layer, which allows for a contextual understanding of transactions, or how multiple database operations constitute a specific business function.
If you want to understand when administrators perform unauthorized alterations or view sensitive information, or be altered when systems are used in a manner inconsistent with best practices, DAM is a good choice.
DAM can even detect odd behavior that is hard to quantify but just doesnt look right -- such as when someone requests too much information or makes unusual requests.
Its the understanding of the database layer that allows DAM to provide both qualitative and quantitative analysis of events across multiple requesting applications and databases. Its this focus that allows DAM to provide value beyond traditional security information and event management or intrusion-detection systems, both of which collect generic system and network events.
DAM systems have been commercially available for more than a decade, and the platforms offer mature functions that scale with the IT systems they monitor. Here are the principal reasons companies use DAM products:
SQL Injection protection.
DAM can filter and protect against many variants of SQL injection. While it does not provide completeprevention, statement and behavioral analysis techniques catch a great deal of known and previously unknown attacks. By whitelisting queries as acceptable from specific applications, DAM can detect most queries that have been tampered with and queries originating from unapproved applications.
DAM also can be deployed to block SQL injection and other attacks -- called virtual patching-- often before database vendors provide patches. Statements can be blocked before executing in the database, so there is no damage to data or the platform.
Behavioral monitoring.
DAM systems capture and record activity profiles, both of generic user accounts and of specific database users. Detected changes in a specific users behavior can indicate a disgruntled employee, hijacked accounts or even cases of oversubscribed permissions. Or maybe youre worried about attacks from mysterious Russian hackers or the much-hyped insider threat. Behavioral monitoring is an effective technique to detect misuse, regardless of the source.
For a look at some of the other reasons why companies use DAM -- as well as a detailed guide on how to evaluate DAM products --
download the free report on database activity monitoring
.
Have a comment on this story? Please click Add a Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
A Guide To Practical Database Monitoring