Role of Database Activity Monitoring in Database Security

By: Neelesh Kripalani

If you ask any security administrator that what according to him/her is the most important resource of the organization? The most common answer you’ll get is the ‘database’. That’s because it contains sensitive and vital information related to an organization ranging from financial details to sensitive data about customers, partners, or employees.

Now the question is who has access to this data? That includes primarily the database administrators (with complete access), followed by some other users (with restricted access). What if the any of these users misuse their access with malicious intent? Or if their account gets hacked?

In the recent times, especially after the COVID-19 outbreak, there has been a substantial increase in cyberattacks.

Research shows that, more than 3.2 million records were exposed in the 10 biggest data breaches in the first half of 2020. Significant percent of these records breached involved a database.

The Challenge

Organizations store their most valuable and sensitive information in a database. Perimeter protection and basic security provided with the database don’t have sufficient protection from today’s sophisticated hackers or rogue insiders.

Average cyber-criminal is lazy and will scrape up any data exposed by running automated online scripts looking for unsecured databases. Managing such a risk needs more than simply dropping in a firewall or installing antivirus software. Further, the databases and applications run in complex environments with numerous dependencies. While we want to protect our information, we need to do it in a way that doesn’t interfere with regular business activities and hamper the productivity.

The Solution: Database Activity Monitoring (DAM)

Techopedia defines database activity monitoring as the process of observing, identifying and reporting a database’s activities. DAM tools use real-time security technology to monitor and analyse configured activities independently and without relying on the DBMS auditing or logs. Simply put, the tool tracks and audits what someone did with their access or how data is viewed and by whom, including the administrator.

Over the past few years, we have seen major changes in both – the threats we face online as well as the regulatory compliance landscape. Both, the bad guys and the regulators are now focused on our data. While a number of tools can monitor various level of database activity, DAM tools are differentiated by their ability to trigger alerts on policy violations. DAM tools not only record activity but also provide real-time monitoring and rule-based alerting which provide immense benefits for security and compliance.

One of the key elements of DAM tool is that the data recorded about database usage is stored outside the database that is being monitored, so the DBAs who are being monitored cannot manipulate the data. Another key element is the ability to send real-time alerts, which helps in handling the policy violation as soon as it is detected.

Here are some of its key benefits:

• Keep track of activities in a database. This is especially important for tracking activities performed by DBAs and accounts used in shared pool configurations
• Measure and track database utilization as well as database performance trends. Forecasts can be made concerning database improvements based on the trends.
• Ensure compliance and meet the stipulations of regulatory bodies and acts. Various acts by regulatory bodies define how data should be handled and protected. DAM tools help in the same.
• Enforce separation of duties of database administrators and prevent the manipulation of recorded activities or logs.

Database is the pivot of a successful organization. However, without a database activity monitoring system, it will be subject to poor performance, policy violation, cyberattacks etc. Thus, ensuring database security with an apt activity monitoring tool is the way to go.

(The author is Senior Vice President and Head- Center of Excellence – Clover Infotech and the views expressed in this article are his own)