Rolling Review: Imperva's Secure Sphere: Page 4 of 6

Too Much Information?

The DSG's user-behavior auditing is much more granular than that of most database server software. Responses from the database can be logged to see what data generated alerts, for example. Although this is useful, it's also a violation waiting to happen. Imagine if an attacker were able to dump 1,500 customer credit-card numbers, and those numbers were included in the DSG's logs. You're in the PCI doghouse. Or, how about queries that include sensitive information as defined by HIPAA or SOX?

Click to enlarge in another window

Fortunately, Imperva addresses this by including a global option to exclude raw queries from logs. Imperva also aids compliance by ensuring separation of duties by moving database logging outside the DBA's purview.

Because the DSG can be placed inline, it can act as a firewall and an IPS, making its $45,000 price tag more palatable. On top of using profiles to determine normal traffic, the DSG includes signatures for known attacks and protocol decoders to detect anomalies that could indicate an attack. Imperva told us that since most customers have firewalls in place, this is one of the lesser-used features, but we consider it a nice addition to help in a layered-defense security model.