Database access audit
09.06.2020
Back to blog listDatabases store a critical amount of information and often become the source of the largest data breaches. Database Monitor protects information in databases and shows the ways in which users work with them in order to detect a threat and prevent an incident.
Learn more about Database Monitor solution
The system is a DAM (Database Activity Monitoring) solution and conduct automated monitoring and auditing of operations on databases allowing a specialist to see who and why accesses a database, which information gets exposed or used, changed and removed. The software analyses the information which is exported from a database and detects an employee attempt to download, edit or delete confidential corporate details, such as tax reporting or client information, etc.
Database Monitor detects all the requests to databases from business applications or privileged users who access DBMS directly – for example, system administrators who have rights to manage databases. This allows a company to monitor their activity and alert to violations. Besides, the function helps discover spyware which accesses
databases to steal data. Database Monitor controls DBMS efficiency – the software creates a report based on the speed of request processing and errors during request execution. The general statistics on database status is available as a user-friendly dashboard.
“DAM solutions are needed to detect anomalous events in databases promptly. We went further and added investigating functions to the monitoring in order to fully protect databases from insider threats. Any request to databases can be found manually or automatically in Database Monitor: by phrase, by user, by computer or IP address from which it was sent. The same way the system analyses which information a database sends in response and allows to search by the content of the responses. For example, the cases when passport numbers are exported from a database can be found with the help of the search by a typical sequence of digits – thanks to this a customer can control all the dangerous events whether it is an export of confidential data or a large amount of requests from one user. The system will save all the details and alert to the possible incident,” comments Alexey Parfentiev, leading analyst at SearchInform.
The solution can be integrated with other information security and risk management systems, including DLP, file auditing, SIEM. When using Database Monitor together with SearchInform products a specialist can control security events at each level of IT infrastructure within one interface. This ensures a complex approach to data protection in databases: allows you to investigate incidents easily and gather evidence.
