WIXLIB

Information ManagementData SheetFederal GovernmentIBM InfoSphere Guardiumfor federal informationsystemsContinuous monitoring to secure sensitive data andsimplify SCAP compliance validationHighlights Continuously monitor data activity toidentify and block unauthorized accessor changes, including those initiated byprivileged users Automate assessment of databaseconfigurations to identify securityvulnerabilities and suggest prioritizedremedial actions Simplify and automate the implementationof controls to demonstrate compliancewith the Federal Information SecurityManagement Act, OMB, SP 800-53 andother mandates Maximize security and interoperabilityby supporting federal standards and bestpractices including DISA Database STIGvulnerability tests and CVE identifiers Monitor, aggregate and understanddatabase entitlements Build security into big data environmentssuch as Hadoop, InfoSphere BigInsights and NoSQL databasesThe challenge of protecting data and validatingcompliance in federal agenciesAccording to a March 2013 article in Reuters, cyber attacks and cyberespionage have supplanted terrorism as the top security threat facingthe United States.1 Cleanup from cyberattacks cost an average ofUSD8.9 million annually.2 The types of sensitive information targetedin attacks are typically stored in databases, and increasingly in big datarepositories, such as Hadoop. As a result, the implementation of datasecurity controls is becoming a very high priority. Furthermore, recenthigh profile events have called attention to the fact that these controlsmust also encompass the protection of sensitive data from insiders,particularly administrators who most often have unfettered access toall the data they manage.“We know hackers steal peoples’ identities andinfiltrate private email. We know foreign countriesand companies swipe our corporate secrets. Now ourenemies are also seeking the ability to sabotage ourpower grid, our financial institutions, and our airtraffic control systems.”3— President Obama, State of the Union address 2013

Information ManagementData SheetFederal GovernmentIn response to the escalating threat to federal informationsystems, a variety of legislative and regulatory mandates nowrequire federal agencies to implement controls to protectsensitive data. These include Federal Information SecurityManagement Act (FISMA) and National Instituteof Standards and Technology (NIST) standards such asFederal Information Processing Standards (FIPS)-200, SpecialPublications (SP) 800-53 and Security Content AutomationProtocol (SCAP) (SP 800-126). Recognizing the real-timenature of current threats and the limited impact that staticcontrols implemented in the past have had on attacks, mostagencies are now moving aggressively to meet compliancerequirements with capabilities that enable real-time detectionand mitigation of security vulnerabilities.Managing a database infrastructure to address these evolvingsecurity and compliance requirements is quite challenging fora variety of reasons, including: “Agencies need to be able to continuouslymonitor security-related information fromacross the enterprise in a manageable andactionable way. To do this, agencies need toautomate security-related activities andacquire the tools that correlate and analyzesecurity-related information.”4 — Vivek Kundra, Federal CIO2The shortage of resources with required database andsecurity skillsThe number of systems to be secured, which can range upinto the thousands in large agenciesThe highly dynamic nature of these systems, which undergoconstant changesThe need to implement consistent controls and reportingon systems from a variety of vendorsThe effort required to assemble and organize the widevariety of information required to demonstrate compliancewith all applicable mandatesThe explosive amount of data speeding through theenterprise, which makes it challenging to understandwhat is sensitive and how to protect itThe increasing adoption of big data platforms, such asHadoop and NoSQL, which means that existing approachesmight not scale to embrace new types of data sources

Information ManagementData SheetFederal GovernmentAn integrated solution to meet growingdata security and compliancerequirementsIBM InfoSphere Guardium offers a family of integratedmodules for managing the entire data security and compliancelife cycle (see Figure 1), irrespective of the size and mix ofplatforms. Supported platforms include Oracle Database,Microsoft SQL Server, Microsoft SharePoint, IBM DB2 ,IBM Informix , IBM VSAM, Sun MySQL, Sybase ASE,Sybase IQ, IBM PureData , Teradata, PostgreSQL and FTPproducts. In addition, to address the challenges of security forbig data, InfoSphere Guardium supports Hadoop-basedsystems, such as Cloudera and InfoSphere BigInsights ,as well as NoSQL databases.Monitor&AuditEnforce&ProtectCritical ed to provide ease of use and optimize the utilizationof operational resources, InfoSphere Guardium provides ameans of automating: The identification and classification of unregistereddatabase instances, so that you can ensure controlsare applied to all sensitive data, even in highlydynamic environmentsThe continuous assessment of database infrastructuresto identify, prioritize and accelerate remediation ofvulner abilities that can be exploited to compromisesensitive dataThe real-time monitoring and enforcement of policiesfor sensitive data useThe collection and reporting of audit information tovalidate compliance with a range of mandatesFigure 1: InfoSphere Guardium is a single integrated solution that simplifiesall facets of data security and compliance3

Information ManagementData SheetFederal GovernmentContinuous monitoring and policyenforcement to protect sensitive datathe security team to blocking the transaction in real time.For maximum scalability and flexibility, multiple tiers ofappliances can be added to accommodate growth, enablingcentralized monitoring and management of security policiesagency wide.InfoSphere Guardium Data Activity Monitor is a simple,scalable solution for centralizing and automating the controlsneeded to protect all kinds of sensitive data in distributedheterogeneous environments, including big data environments.Lightweight host-based probes are installed on any databaseserver with sensitive data, data, enabling all database trans actions to be monitored in real time (see Figure 2) withoutchanging database configurations or enabling resourceintensive native logging facilities. Hardware or softwarecollector appliances gather monitored data from the probes,providing analysis, reporting and the secure audit trailrequired by mandates such as SP 800-53. If a transactionviolates the policies configured by your agency (see Figure 3),a number of responses can be specified, ranging from alertingFigure 3: InfoSphere Guardium continuously monitors data access inreal time to detect policy violations and provides a range of actions forresponding when any are detectedz/OSCloudenvironmentS-TAP for DB2S-TAP for IMSS-TAP for ollectorApplicationserversCollectorAmericas datacentersOracle, SQL Server, DB2(distributed and mainframe)Informix, Sybase, MySQL,Teradata, Netezza, PostgreSQLEurope datacentersCentral Policy Managerand Audit RepositoryShare pointserversS-TAPIntegration with LDAP,IAM, Kerberos, SIEM,Remedy, McAfee ePO,IBM TSM, Tivoli, etc.CollectorSolaris, S-TAP for System iData-levelaccess controlS-TAPCollectorAsia Pacificdata centersFigure 2: The scalable InfoSphere Guardium architecture protects sensitive data in large and small environments with centralized aggregation of audit data andcentralized management of security policies—agency wide4

Information ManagementData SheetFederal GovernmentInfoSphere Guardium Entitlement Reports provide a simplemeans of aggregating, understanding and utilizing user rightsinformation. You can eliminate the time-consuming anderror-prone process of manually collecting and analyzing userrights information and ensure important security gaps arequickly identified, while reducing operational costs throughautomation. InfoSphere Guardium can be configured to scanall selected databases on a scheduled basis, automaticallycollecting information on user rights. The result is the abilityto maximize sensitive data protection, minimize operationalcosts and ensure successful audits.One of the biggest trends in federal information systems is themove to big data infrastructures. Big data environments helpagencies process, analyze and derive maximum value fromnew data formats, as well as traditional structured formats, inreal time. As big data environments ingest more data, agencieswill face significant risks and threats to the repositoriescontaining this data. Unique challenges of big dataenvironments include:Key pre-defined Entitlement Reports include: Accounts with system privilegesAll system and administrative privileges, shown bothby user and roleObject privileges by userAll objects with public accessUser privileges by objectRoles granted to users and rolesGrants and revocation of privilegesExecute privileges by procedure Schema-less distributed environments, where data frommultiple sources can be joined and aggregated in arbitraryways, make it challenging to establish access controlsThe nature of big data — high volume, variety andvelocity — makes it difficult to ensure data integrityAggregation of data from across the enterprise meanssensitive data is in a repositoryAnother data source to secure, and most existing datasecurity and compliance approaches will not scaleInfoSphere Guardium is among the first to market to deliversecurity for data environments by monitoring big data activityfrom applications and users (both internal and external) in realtime and taking action on policy violations. InfoSphere Guardiumalso reports on activities to fulfill compliance requirementsand support forensic investigations.5