These systems are the most difficult to secure because they are highly distributed and designed to allow Web-based access from insiders and outsiders, such as customers, suppliers, and partners.

In addition, multi-tier enterprise applications mask the identity of end-users at the database transaction level using an optimization mechanism known as “connection pooling.” Using pooled connections, the application aggregates all user traffic within a few database connections that are identified only by a generic service account name.? As a result, organizations find it challenging to associate specific database transactions with particular application end-users.

The primary purpose of application-layer monitoring is to detect fraud (and other abuses of legitimate access) that occurs via enterprise applications, rather than via direct access to the database.? This level of monitoring is often required for data governance requirements such as SOX. New auditor guidance from the Public Company Accounting Oversight Board for Sarbanes-Oxley compliance has also increased the emphasis on anti-fraud controls.

Guardium’s application monitoring technology resolves application user-IDs by observing all interactions between applications and database servers at the network and OS level—from outside the database.? The information is then incorporated into all Guardium queries, reports, audit processes, alerts, and policies.

Highlights