Your Enterprise Database Security Strategy 2010

September 28, 2009
Your Enterprise Database Security
Strategy 2010by Noel Yuhannafor Application Development & Program Management Professionals
Making Leaders Successful Every DayFor Application Development & Program Management Professionals
September 28, 2009
Your Enterprise Database Security Strategy 2010Stronger Measures Have Become Essential To Defend Against Growing Attacksby Noel Yuhannawith Mike Gilpin and Adam Knoll
Executive SummaryWith increasingly sophisticated attacks and rising internal data theft, database security merits a stronger focus that goes beyond traditional authentication, authorization, and access control (AAA). A single intrusion that compromises private data such as credit card numbers, social security numbers, or other financial data can cause immense damage to an enterprise's reputation, not to mention initiating lawsuits and regulatory fines that can have long-term impact. Database security is the last line of defense, so it deserves greater focus on the protection of private data from both internal and external attacks than IT pros have traditionally given it. Database security professionals and information security and risk management professionals crafting a security strategy should: 1) align database security policies with information security policies; 2) ensure well-defined and formalized database security procedures; 3) enforce role separation; and 4) apply advanced security measures such as database auditing, monitoring, database encryption, data masking, and vulnerability assessment to all critical databases that store private data.
table of Contents NOTES & RESOURCES2 Databases Need Tighter Security To Protect Forrester interviewed 17 vendor and user Against Threats companies, including IBM, Microsoft, Oracle, and Basic Database Security Measures Are No Sybase.Longer Sufficient To Protect Private Data2 Enterprises Must Establish A Comprehensive Related Research DocumentsDatabase Security Strategy "The Forrester WaveT: Enterprise Database Management Systems, Q2 2009"Discovery, Classification, Database AAA, And June 30, 2009Patch Management Provide The FoundationPreventive Measures Build On Top Of The "Market Overview: Database Security"Foundation, Offering Added Layers Of February 27, 2009ProtectionDetecting Anomalies And Performing Routine Security Checks Completes Your Strategy 7 Don't Forget Security Policies, Standards, Role Separation, And Availabilityrecommendations8 All Enterprises Need A Database Security Strategy
© 2009, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. To purchase reprints of this document, please email clientsupport@forrester.com. For additional information, go to www.forrester.com.2 Your Enterprise Database Security Strategy 2010 For Application Development & Program Management Professionals
DATABASES NEED Tighter SECURITY TO PROTECT AGAINST THREATSToday, all enterprises use database management system (DBMS) technology to store critical business data. All data is important, but private data matters most. A single intrusion that compromises private data such as credit card numbers or financial data can cause immense damage to an organization, whether big or small. Databases are often the prime target of such attacks, largely because they hold the most-valuable data and are vulnerable unless carefully secured. Recently, in the largest data theft in US history, a Florida man pleaded guilty to stealing more than 170 million credit and debit card account numbers from large retailers such as Sports Authority, OfficeMax, 1and Barnes & Noble. He used various techniques including SQL injection to locate and crack into databases after he identified security holes. More recently, Network Solutions made headlines when it disclosed that hackers planted rogue code that resulted in compromising more than 573,000 debit and credit card accounts. Hackers will find new ways to break into databases; therefore, enterprises need to be more vigilant and take proactive measures to safeguard their data.
Basic Database Security Measures Ar... [download for more]