Four Database Security Best Practices to Implement Right Now

How safe is your data center?
If the average budget allocation is any indication, the prognosis isn’t good.
According to the International Data Corporation (IDC), out of $27 billion cumulative worldwide spending on security products, a mere five percent addressed data center security. For businesses who rely on data centers, that’s a staggering shortfall.
Thankfully, a separate report by the Online Trust Alliance found that most security breaches of data centers were easily preventable, if a few simple steps were followed. Out of the top ten database threats identified by Imperva, the majority can be addressed by maintaining a series of best practices incorporated in your business’ day-to-day activities and supplemented by deploying the right applications.
1. Discover
Simply put, you can’t protect critical-business data and applications if you don’t know what data is most sensitive. Despite the old truism, what you don’t know can certainly hurt you, in more ways than one.
For starters, not all data is created equal. A thorough discovery process will identify exactly what data is most at risk of being targeted by attacks. Naturally, this includes financial information, client data, and intellectual property. However, it also must address who has access to that data within your organization, who it’s being shared with, and data permission settings.
Second, database privileges are themselves vulnerable to abuse by insiders both with and without malicious agendas. A well-intentioned email click could easily expose you to malware or comprise your login and password credentials. Copying production data to an unmanaged testing server likewise leaves your data unprotected, which is why permission settings are so vital.
With key digital assets like your intellectual property, financial information, customer information, and research data at stake, comprehensive threat discovery tools like Imperva SecureSphere Database Assessment are built to locate sensitive data down to the database object, row, and column. Combined object-level and column-level classification lets your organization zero in on in-scope data as well as develop granular policies that streamline protection, auditing, and reporting. After sensitive data locations are found, a risk-based prioritization follows to help companies formulate risk mitigation programs and policies.
2. Monitor
With cybercrime syndicates, hacktivists, and even opportunistic insiders all waiting for an opening to get past your IT defenses, vigilance has become increasingly vital to keep your data secure. If you know where the threats are coming from, you can stop their progress before your data center gets compromised.
However, vigilance has its limits. You don’t want monitoring solutions to impact your system’s overall speed and performance. Manual monitoring of the threat horizon is simply too time- and labor-intensive given the diffuse nature of today’s threats. Instead, you need to automate your security and compliance to keep your data safe even with a high volume of database traffic.
Imperva SecureSphere for Data balances these needs by monitoring audit access across all data stores, rectifying user rights for dormant users and unauthorized personnel, and accelerating incident response and analysis. Best of all, it can do all this without negatively affecting system performance, availability, and regulatory compliance.
3. Alert
Sophisticated attacks on your data – like malware, Heartbleed, DROWN, and man-in-the-middle – are often hidden within inoffensive looking but encrypted traffic and, as a result, are all but invisible.
The answer lies in an alert system that constantly updates itself against evolving attack methods. A system that absorbs real-time threat intelligence offers far more protection than a manually-updated database of threats; it also frees security personnel to focus on more important tasks.
Utilities like Imperva SecureSphere Web Application Firewall interpose themselves between your system and the constantly-evolving threats from outside, dynamically learning your system’s “normal” behavior and cross-referencing it with ThreatRadar: a growing, constantly-updated database of threats crowd-sourced from all across the Web.
Users are thereby immediately alerted to threats through a monitoring and reporting framework that provides a comprehensive overview of your security as well as compliance and content delivery status. With this alert system in place, you can stay on top of your defenses… and deploy a response proportionate to the intensity of the attack.
4. Comply
Recent court rulings have placed the onus for customer data protection squarely on the hosting company. What’s more, the definition of “customer damage” has expanded significantly by findings like those made by an appellate court in the case of Neiman Marcus’ data breach.
Even without the threat of lawsuits hanging over your head, ever-expanding regulations and privacy acts keep organizations busy making sense of the increasing complexity of technical implementations. You often need a third party to help you implement regulatory requirements and simplify compliance efforts across the organization.
Compliance can be built right into security applications, like Imperva SecureSphere Database Assessment and its automatic database protection that conforms to regulations, best practices, and a company’s internal governance policies.
Database Security Best Practices
So, how safe is your data center?
The only way to be sure is by following four database security best practices: (1) discover, (2) monitor, (3) alert, and (4) comply.
Do not be among the majority of companies whose lack of commitment at both the financial and operational levels leaves them wide open to breaches.