InfoSecChat

So many products, so many choices

a1 how do you correlate all those sources?

A2: Don't know the market or the tools

A2: Choosing the right tech - market is strewn with stuff that does not do what it's supposed to

A2: Also, finding technologies that integrate, so you can manage entitlements and identities, as well as appropriately control access to sensitive data.

Accountability, sometimes privileged users share the same credentials

@AdrianLane a2 or claims it can and does not scale. Unmanageable mess

working with large heterogeneours environments, with people and data changing all the time

A2: Even then, using right data source or write policies

a2 and know your 'good

Understanding where sensitive data is, and how to protect it.

a2 and know your good from bad activity. Don't block good stuff!

Being able to react to a possible threat in real time.

scoping the problem to only mitigating the essential risks

a2 @cascoarias if you're not realtime, it's like driving using the rear view mirror. You're gonna crash!

Finding technology solutions that can span the entire landscape of applications which a company may have

@SetDeep right you are- the most difficult especially new technology like HADOOP and Spark

... and that are able to protect sensitive data and integrate with entitlement management solutions

most organizations have a smorgasbord of applications spanning from mainframe based to on the cloud linked together by a veritable spaghetti bowl of interfaces

any security application needs to seamlessly span the entire gamut as the "insider" criss-crosses across these

Ha Ha U tell us!

A4: It's possible to monitor SAP and Oracle application events in real time

A4: It's possible to monitor user activity in a SharePoint environment

A4: It's possible to monitor file access - It's possible to see Hive queries in NoSQL

A4: DAM let's you monitor and tie all that together

does it have alerts and notifications

A4: Guardium helps with the automated discovery and classification of sensitive data -- so you know what you need to protect.

@SetDeep Guardium has the ability to spot abnormal behavior and to block access and/or send alerts

does it have some predictive analytics capabilities helping in identifying potential threats based on patterns of events

@SetDeep All DAM platforms do - it's basic - email, SMS and console alters. And filter repeats.

it also helps you understand the entitlement privileged users have to that data

Sorry - Database Activity Monitoring == DAM

@SetDeep Guardium has analytics and machine learning built in

cool

also helps look at forensics on the access to all sensitive data, and assess the amount of risk you may have.

It enables organization to craft a risk mitigation strategy for the static data

@SetDeep We think so too ;-)

whats its track record been at places where it is at work

Then it can monitor in real time tor instant mitigation of dynamic risk (how people access the data)

false-positives etc

@SetDeep A4: Not predictive per se, bu behavioral, metadata analysis, semantic and a couple others

It can even identify anomalous behavior through machine learning algorithms and outlier detectino

And finally, you can protect the sensitive data access with alerting, logging, blocking, quarantining, or masking data dynamically

@SetDeep A4: Depends - very in cases of data misuse. SQL injection depends

"Blame it on Watson" ;-)

A DBA who was caught colluding with a mortgage broker and we found the activity during a proof of concept

one was sure they understood exactly where their sensitive data was, until we did the POC and discovered 113 servers with sensitive data

@cascoarias that would be eye opening!

Hospital employees selling info on celebrity patients

another customer stopped the POC because we found too many privileged user vulnerabilities, and politely asked us to leave until they fixed the issue.

Remember - Worldcom CEO/CFO fraud was exposed though database activity

a3 a Data Warehouse project , another pilot, where we found contractors sharing the Netezza Admin credential. Baaaaaad.

On a briefing a CIO looked intensively at their IT manager when we pointed out that 65% of enterprises do not know what their DBA are doing.

Yes - CrowdChat is turing funny colors

@CCBigData Which just underscores the need to know what people are doing with their credentials!

@CCBigData Yikes. Making real time monitoring that much more important!! #InfoSecChat

Target discovered that an extra 70M customers records were stolen many months ago, only after taking the time to look at audit records. They could have found it with real time monitoring.