IBM Security Guardium is a comprehensive data security platform that provides a full range of

capabilities – from discovery and classification of sensitive data to vulnerability assessment to

data and file activity monitoring to masking, encryption, blocking, alerting and quarantining to
protect sensitive data. Guardium helps secure sensitive data across a full range of
environments – from databases to big data, cloud, file systems and more. Guardium also
provides automated analysis to quickly uncover internal and external risks to sensitive data

What does Guardium monitor?

 SQL Errors and failed logins

 DDL commands (Create/Drop/Alter Tables)
 SELECT queries
 DML commands (Insert, Update, Delete)
 DCL commands (Grant, Revoke)
 Procedural languages
 XML executed by database
 Returned results sets

Real-Time Database Monitoring with InfoSphere Guardium Host-based Probes (S-TAPs)

Collector

 Non-invasive architecture
 Outside database
 Minimal performance impact (2-3)
 No DBMS or application changes
 Cross-DBMS solution
 100 visibility including local DBA access

 Enforces separation of duties

 Does not rely on DBMS-resident logs that can
easily be erased by attackers, rogue insiders
 Granular, real-time policies auditing
 Who, what, when, how
 Automated compliance reporting, sign-offs
escalations (SOX, PCI, NIST, etc.)

How are most databases audited today?

 Reliance on native audit logs within DBMS

 Lacks visibility and granularity
 Privileged users difficult to monitor
 Tracing the real user of application is
difficult
 Level of audit detail is insufficient
 Inefficient and costly
 Impacts database performance
 Large log files provide little value
 Different methods for each DB type
 No segregation of duties
 DBAs manage monitoring system
  Privileged users can bypass the system
 Audit trail is unsecured

The Compliance Mandate

DDL Data Definition Language (aka schema

changes) DML Data Manipulation Language (data
value changes) DCL Data Control Language
Database Activity Monitoring Three Key Business Drivers

 Prevent data breaches

 Mitigate external and internal threats
 Ensure data integrity
 Prevent unauthorized changes to sensitive data
 Reduce cost of compliance
 Automate and centralize controls
 Across DBMS platforms and applications
 Across SOX, PCI, SAS70,
 Simplify processes