Database Activity Monitoring (DAM)
Another security layer of a more sophisticated nature includes real-time database activity monitoring, either by analyzing protocol traffic (SQL) over the network, or by observing local database activity on each server using software agents, or both. Use of agents or native logging is required to capture activities executed on the database server, which typically include the activities of the database administrator. Agents allow this information to be captured in a fashion that can not be disabled by the database administrator, who has the ability to disable or modify native audit logs.
Analysis can be performed to identify known exploits or policy breaches, or baselines can be captured over time to build a normal pattern used for detection of anomalous activity that could be indicative of intrusion. These systems can provide a comprehensive Database audit trail in addition to the intrusion detection mechanisms, and some systems can also provide protection by terminating user sessions and/or quarantining users demonstrating suspicious behavior. Some systems are designed to support separation of duties (SOD), which is a typical requirement of auditors. SOD requires that the database administrators who are typically monitored as part of the DAM, not be able to disable or alter the DAM functionality. This requires the DAM audit trail to be securely stored in a separate system not administered by the database administration group.
Read more about this topic: Database Security
Famous quotes containing the word activity:
“In literary circles, the men of trust and consideration, bookmakers, editors, university deans and professors, bishops, too, were by no means men of the largest literary talent, but usually of a low and ordinary intellectuality, with a sort of mercantile activity and working talent. Indifferent hacks and mediocrities tower, by pushing their forces to a lucrative point, or by working power, over multitudes of superior men, in Old as in New England.”
—Ralph Waldo Emerson (1803–1882)