February 22, 2016 By Kathryn Zeidenstein 3 min read

I once spoke at a security roadshow on big data security. One security administrator in the audience was very clear that he understood nothing about databases. He was worried that his knowledge gap was too wide. This is not uncommon for us; when we talk to clients about big data security, they don’t always get it. The history of security is rooted in the network, and organizations don’t necessarily have database experts on their teams or in management roles.

Considering how much data is in databases — which may be accessible to anyone who gets the right passwords through a phishing attack or by accessing the database through a SQL injection attack — it really is critical that there is an understanding of the importance of database security and auditing throughout the organization.

Sure, you may need to learn a few new terms and understand some new roles, but the basic principles for the planning and deployment of a database security and auditing solution aren’t rocket science. I’m sure these considerations are familiar to everyone who works in security.

Assess Risk

Because risk is strategically a factor in everything an organization does, you cannot look at single risk factors and build a plan. An evaluation of risk must bring the business and technical teams together to figure out the data assets most at risk based on their value to the enterprise and the subsequent damage to the business should there be a compliance violation and fine or, even worse, a data breach that goes public.

If you’re not sure where risky data lies (and who really is?), use automated discovery and classification tools to pinpoint databases and files that contain high-risk data such as personally identifiable information (PII) and financial data.

Data protection program providers are available if you need help brokering the discussion. Often, there can be a real disconnect in communication and vocabulary between people who understand data and its unique security requirements, those who are traditional security professionals who understand networks and firewalls and business owners.

Define the Objectives and Staging

Define the objectives and staging for your data security plan. Don’t boil the ocean in phase one; think agile and show interim successes. For example:

  • Run database-specific vulnerability scanning to find and fix low-hanging fruit such as bad database configuration parameters, poor password policies or default passwords. This is a low-impact operation that creates actionable work items for the DBA teams that can reduce risk. You can also show management measurable results in the form of improved scores. In the meantime, be planning and implementing database activity monitoring (DAM).
  • Deploy basic DAM and reporting of the most critical objects and/or those that require reporting for an imminent compliance deadline. This step will get you familiar with implementing DAM and reporting while helping you fine-tune security policies.
    • At this point, you may find not only risky activity, but also issues that the application and database teams would like to know about, such as a high volume of SQL errors that are thrown because of a missing package or long execution times because of an accidentally dropped index. Look for such ways to show the value of DAM to your DBA and application teams. This paves the way for more cooperation moving forward.
  • Add privileged user monitoring and reporting required for compliance and to help protect against insider threats.
  • Implement real-time and threshold-based alerting for communication with the security operations center. It’s very easy to integrate real-time alerts with your SIEM system.

An aside here that bears stating explicitly even though it’s project management 101: Make sure your plan allows for hiccups. Even a project with small scope and lower complexity can be delayed for a variety of reasons such as database or OS upgrades, ports that need opening, change ticket approvals that take forever, vacations and more.

After Success, Expand the Scope

After the initial success with your project, expand the footprint by adding more data sources including file data, big data or tier-2 databases. Make sure you re-evaluate your reporting and alerting requirements. As you expand the DAM footprint, learn how to use the automation capabilities to make the workload easier via intelligent scheduling, automating the population of groups and workflow automation.

Consider having some team members investigate and implement deeper analytics to help your security analysts focus on the riskiest activity.

Learn more about securing the data that powers your business

More from Data Protection

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today