Guardium, the database security company, today announced the first database monitoring and security solution that provides granular visibility into all changes to database objects û including database structures, permissions, data, and configuration files û without relying on database-resident functions such as trace and transaction logs or native auditing.

Most organizations have formal change control policies and processes that govern how and when changes are made to production databases. Until now, however, there were no effective and tamper-proof solutions for detecting when critical changes were made outside of these policies and processes.

The new Guardium offering, called Change Control Solution for Databases, enhances the security, integrity, and availability of critical data and systems by alerting security and IT managers on all unauthorized changes by trusted insiders and external hackers. The technology also dramatically reduces staff time required to address auditors' requirements by automatically creating reports that compare all detected changes with approved change requests. This process, known as "change control reconciliation," is increasingly required by auditors to tighten internal controls for critical systems such as Oracle E-Business Suite, PeopleSoft, Siebel, SAP, and in-house SOA applications.

According to Gartner's January 2007 report, Using Configuration Auditing for Compliance Control, "Configuration integrity is a legitimate area of audit concern, and auditors have become more aggressive in evaluating configuration control. Unless the configuration of systems can be verified as being in a known state, neither the integrity nor the confidentiality of the data they contain can be trusted."

Written by Gartner analysts Mark Nicolett, Ronni Colville, and Paul Proctor, the report also states that, "Enabling the appropriate configuration controls will also reduce the risks associated with unauthorized change û which include downtime because of system failure, the introduction of security vulnerabilities, and insider security threats."

Traditional approaches that rely on database-resident auditing functions are impractical for compliance auditing for five important reasons:

• They can easily be disabled by privileged users such as database administrators
• They provide limited audit information
• They require modifications to database configurations
• They degrade the performance of critical production systems
• Native auditing cannot identify end-users who change critical data using multi-tier Web applications such as SAP because these applications "pool" all user traffic into a single stream that uses a common generic ID to access the database.

Automates Change Control Reconciliation for Databases
Guardium's solution automates change reconciliation by tracking the "who, what, when, where, and how" of all database transactions at the network level, while simultaneously monitoring all changes to external database configuration files. It then compares detected changes with authorized change requests from deployed change management systems such as BMC Remedy, HP-Peregrine, and custom applications.

Unauthorized changes û such as those made without change control IDs, during production periods, or with unauthorized user IDs û generate real-time alerts and are flagged for immediate follow-up and remediation, based on customizable policies. The system can also proactively block unauthorized or suspicious activity in real-time to prevent policy violations. To enforce separation of duties and provide a verifiable audit trail, the Guardium solution stores all audit data in a secure repository that cannot be modified by privileged users.

Monitors All Changes to Data and Objects û Both Inside and Outside the Database
Guardium's new solution monitors and provides real-time alerts for changes to all key database objects including:

• External database system objects such as configuration files, environment/registry variables, shell scripts, OS files, and executables such as Java programs. For example, privileged users could turn off database encryption or change the database home directory. To accelerate deployment, the system includes pre-configured templates for all popular OS and database configurations.
• Database structures such as tables, triggers, and stored procedures. For example, it can rapidly identify "logic bombs" planted by disgruntled employees. It can also detect accidental deletions or insertions of critical tables that impact data governance and the quality of business decisions.
• Security and access control objects such as users, roles, and permissions. For example, an outsourced contractor could create a new user account with unfettered access to critical databases and then delete the entire account, eliminating all traces.
• Critical data values such as data that affect the integrity of financial transactions.

"We see a growing need to move beyond data security to address broader data governance and data quality issues that have a major impact on how our customers run their businesses," said Ram Metser, president and CEO, Guardium. "We developed these new change control capabilities in response to feedback from our forward-thinking customers, who asked us for practical, time-saving ways to ensure the integrity of their critical data."

Network Auto-Discovery of Rogue Database Systems
The Guardium solution also enhances security by performing a network auto-discovery of the entire database environment û including applications, users, tables, and databases, even if those databases have not yet been accessed. This function immediately identifies newly-installed rogue databases and unauthorized applications before they affect data security.

Built on Most Widely-Used Solution for Database Activity Monitoring
Guardium's new Change Control Solution for Databases is built on Guardium SQL Guard, the most widely-used solution for database activity monitoring, security, and auditing. The appliance-based system helps enterprises rapidly secure their data and pass their audits (SOX, PCI, data privacy laws, etc.) by providing independent controls around critical data and systems, as well as automated alerting, reporting, escalation, and oversight mechanisms. Its scalable, multi-tier architecture supports industry standards (such as LDAP, SNMP, and SMTP) and has been field-proven to support the most demanding database environments in Global 1000 organizations worldwide.

Guardium's real-time, SQL-aware appliance monitors all network traffic and performs a deep contextual analysis on all database commands (DDL, DML, and DCL) to identify unauthorized or suspicious transactions. In addition, lightweight software probes monitor privileged local database access (such as Secure Shell, named pipes, or shared memory) as well as changes to external configuration files.

Availability and Pricing
Change Control Solution for Databases will be demonstrated at the RSA 2007 Conference in San Francisco, February 5-9 (Booth 312). Customer shipments are scheduled to begin within 60 days. The system supports Oracle, Microsoft SQL Server, IBM DB2 and Informix, and Sybase IQ and ASE. Please contact Guardium for pricing.