Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Good Enough is not Enough When It Comes to Database Security

The threats facing databases today are numerous and constantly evolving as the perimeter continues to fall away in favor of multi-cloud environments. This change means organizations must adopt an in-depth, data-centric security approach that includes a program designed from the ground up to protect databases.

Many products currently available market themselves as capable of handling database security but, in fact, were originally designed for another security purpose, such as server operating system or network vulnerabilities, and then had database security tacked on afterward.

What is needed for today's threat environment is a solution created to protect databases.

To help visualize the threat surface, let's look at some current high-level threats currently in the wild and some issues uncovered by the elite Trustwave SpiderLabs team.

The Threat Facing Databases

The reason why an in-depth approach is necessary is apparent. The dangers facing databases have never been greater. Just take a look at Gh0stcringe.

Gh0stcringe, also known as CirenegRAT, is a remote access trojan (RAT) threat actors use to attack poorly secured databases focusing on Microsoft SQL and MySQL servers. Particularly those servers with weak access credentials or which may no longer be tracked by the organization. GhostCringe is based on the older Gh0stRAT malware, whose leaked source code enabled a new wave of adversaries to create new threats. 

Gh0stCringe is embedded in a system and then connects with its command-and-control server. It is designed to conduct long-term surveillance on a system and can perform numerous malicious tasks, such as keylogging, allowing it to steal login credentials, data exfiltration or download additional payloads.

One of the most common errors organizations make is believing that a solution that regularly scans their database is, in fact, delivering a high level of security.

However, scanning only scratches the surface. What is required is a deep clinical assessment, not only around database vulnerabilities but into other database security aspects / initiatives that organizations have.

So, what other areas must a true database security solution investigate? 

Going Beyond the Scan

As we can see with Gh0stCringe, having strong passwords is key when it comes to securing a database.

It is an unfortunate reality, but the human element is the weak link to database security. That means any solution must ensure that an organization has a strong password policy in place and ensures that the organization is following the policy.

The solution must make certain that workers are not using easily guessed passwords like "Password123" and the technology should have the capability to create a "password dictionary" specific to that organization. A password dictionary is a listing of words and phrases that are likely to be chosen by an employee but are, in fact, so obvious that threat actors could easily decipher them and gain unauthorized access.

For example, if a company is located in Texas, any passwords containing that word will be automatically disallowed.

A security product should include the ability to manage user access rights to support the organization's zero trust initiatives. Additionally, a world class solution should also provide database activity monitoring with anomaly detection to identify and act on suspicious or malicious activity.

Sensitive data discovery is another necessary feature. A well-designed database security program that includes this feature cannot only find sensitive data, discover who has access and can lock down an environment when needed.

The final feature set one must look for when searching for a solution is the ability to validate that all of an organization's systems are in sync, that all the databases are configured in the same manner and that any legacy systems that might be buried and forgotten deep in a network are found and then tracked. 

Trustwave's Database Security Offering

Trustwave DbProtect proactively assesses threats to databases to help you gain visibility into the vulnerabilities in your on-premises or cloud databases that could lead to a data breach. 

Trustwave has in place 78 different policies, which are custom checklists with specific target audiences in mind. Security teams use these policies to support a variety of compliance regulations, including Australian Government ISM and Australian Signals Directorate's ACSC, HIPAA, GDPR, FISMA, and the DoD DISA Security Technical Implementation Guides.

DbProtect automates securing critical data by uncovering vulnerabilities that attackers can exploit, limiting user access to the most sensitive data, and alerting suspicious activities, intrusions, and policy violations. As a result, you can spend less time chasing database security alerts and more time on activities that drive value, like remediating risks and reducing your attack surface.

Trustwave has multiple checks in place that helps DBAs and security staffers ensure that their data is well protected.

These include ensuring that databases are up to date on patches, and preventing attackers from exploiting publicly disclosed vulnerabilities. While this is cybersecurity 101, it is often ignored with security teams using the excuse, "but my database is in a separate network segment, etc." However, this set up is easily circumvented by an adversary that has already infiltrated the customers network, or an insider.

Trustwave makes certain permissions to access data are granular and follow best practices to minimize the impact of malicious activity and that database and operating systems are configured to minimize the client's attack surface and potential impact from an attack. Finally, we properly configure logging to allow for monitoring of database activities and forensic analysis.

DbProtect's key benefits:

  • 7x more database-specific security and compliance checks vs. vulnerability assessment tools. DbProtect delivers database security and not just compliance
  • 100+ hours saved per database audit vs. manual processes reducing stress on your limited personnel
  • 0 required proprietary appliances or license increases as databases grow, simplifying implementation and reducing total cost
  • 12 annual knowledgebase updates vs. quarterly updates from other solutions, so you have the latest and best knowledge from the SpiderLabs database team
  • 150+ member strong Trustwave SpiderLabs database research team focused only on database security and able to provide clear guidance on how to remediate weaknesses
  • 5,000+ purpose-built database checks that guide a customized monitoring approach
  • 200+ database-specific vulnerabilities discovered by Trustwave threat researchers.

 

security colony

Latest Trustwave Blogs

Trustwave Named in 2024 Gartner® Market Guide for Managed Detection and Response (MDR)

For the second consecutive year, Trustwave has been named a Representative Vendor in the 2024 Gartner® Market Guide for Managed Detection and Response.

Read More

6 Steps on How to Respond to a Data Breach Before it Ruins Your Business

Too many consumers have awoken one morning to find messages from a retailer or their bank detailing purchases made through their account of which they were unaware. While the realization that they...

Read More

Understanding the Impact of AI on Data Privacy

The world is just beginning to understand how the intersection of artificial intelligence (AI) and data privacy will impact organizations, their employees, and those who use their services. As of...

Read More