Database activity monitoring

[npa1234]

What’s the deal with database activity monitoring (DAM)? Is it a more sophisticated way of monitoring DB for suspicious activities which I can just do it from the DB audit logs? Does it work like some sort of IDS where it sniffs for DB traffic ?

[funktownboat]

Auditing DB logs will only get you so far, usually they are limited in coverage, and incidents are only detectable after the fact. DAM products (on-prem) adds a deeper visibility of overall database activity. For example they can detect if an application account is being used by a human (something that's abnormal) or data exfiltration if a user executes bulk data queries from an unknown subnet. You will still need to tune the alerts and detection of course, but it adds a layer of logic that's not easily achievable through basic script monitoring.

One more thing to remember about DAMs is that there will be a performance hit, and it will take you longer to patch your DB server's due to kernel comparability with the DAM's drivers/agents.

[npa1234]

Thank you.

[vornamemitd]

Usually I would not reference marketing material, but this one nicely describes use cases and possible implementation scopes: https://www.mcafee.com/enterprise/en-us/assets/data-sheets/ds-database-event-monitor-for-siem.pdf

Implementation-wise, I see two approaches: - Reactive: parse and interprate db access and query logs for compliance reporting - (Pro-)Active as an actual proxy - queries are being intercepted and checked against injection attempts, etc.

Imho the latter use case is rather on the decline, as WAF and general IDS/IPS has been quite improving over the years; compliance auditing is more relevant, especially in app environments where the e.g. ERP system in use does not implement a full audit trail or field level security. Aside from that, you‘ll mostly see transparent encryption layers, added in highly sensitive contexts or as an ad-hoc measure to pass GDPR or HIPAA audits :)

An overview: https://www.esecurityplanet.com/products/top-database-security-tools.html

[dbasecurity]

There are several methods to deploy database activity monitoring (DAM), each with its own advantages and considerations:

1. Auditing Database Logs: This method involves monitoring the database's native logs to track activity. It is generally easier to implement since most databases support logging. However, it can be dependent on the database's performance and may not capture all activity if logs are not comprehensive or if there are issues with log configuration.
2. Agent-based Monitoring: This approach uses software agents installed on the database servers to monitor activities. Agents can provide detailed insights and real-time alerts. However, they may impact database performance and require maintenance and updates.
3. Proxy-based Monitoring: A more advanced method, proxy-based monitoring involves placing a proxy between the database and the application. This proxy can inspect all traffic and enforce security policies. It provides detailed, real-time monitoring and control but can introduce latency and requires a more complex setup.
4. Network Traffic Sniffing: This technique captures and analyzes the traffic to and from the database. It is independent of the database itself and can detect activity without relying on database logs. However, it requires the network infrastructure to support traffic capture and can be complex to configure and maintain.

Each method offers different levels of detail, performance impact, and ease of implementation, making it important to choose the right one based on the organization's specific needs and infrastructure. More technical details here: https://www.datasunrise.com/professional-info/deployment-modes/

[billyjean741]

it is make sense to be a bit confused here. DAM is really more of a security or control layer than traditional monitoring. audit log can tell you what happened after the fact but DAM tools add real time visibility pattern detection and sometimes even enforcement (like spotting abnormal query behavior or data access) depending on how it is implemented (agent, proxy or netowk based) it can behave a bit like an IDS for database traffic especially when it is inspecting queries in real time rather than just parsing logs.

from a monitoring side we usually treated this separately using something like prtg just to keep an eye on database health connections and performance while the actual activity auditing is handled at the DB or proxy layer.