Podcast: Ensuring Database Security & Integrity

Data Security Podcast

In a recent podcast interview with Hillarie McClure, Multimedia Director of Cybercrime Magazine,  Robert E. Johnson III, Cimcor CEO/President, discusses the latest views on database security and integrity along with the importance of continuous system integrity monitoring for businesses. The podcast can be listened to in its entirety below.

Welcome to The Data Security Podcast sponsored by Cimcor. Cimcor develops innovative, next-generation file integrity monitoring software. The CimTrak Integrity Suite monitors and protects a wide range of physical, network, cloud, and virtual IT assets in real-time while providing detailed forensic information about all changes. Securing your infrastructure with CimTrak helps you get compliant and stay that way. You can find out more about Cimcor and CimTrak on the web at cimcor.com/cimtrak. 

Q: Joining us today as President and CEO Robert E Johnson, III. Robert has been a pioneer in the development of next-gen system integrity monitoring, self-healing systems, and cybersecurity software. Robert, always a pleasure. Welcome back on to the show.

A: Hello, Hillarie, great to be back on the show with you.

Q: So, Robert, today let's talk about database integrity. For anyone unaware who's listening, what does that really mean?

A: Well, that's a good question, Hillary. I think before I jump into database integrity, let's just talk for a moment about how databases are designed. What are the big three components? So, the three primary components of almost any database is: number one, and this is what people typically think about when they think about databases, and that's all the data. You know, every transaction going into a database and being stored for archival purposes or for future retrieval. All of that data that goes into the database and being created out of the database is what we typically think of database is only one-third, is one component of what makes that database run. But it's a critical piece, your data.

Now, the next two components are really often forgotten. So, the second component and overlooked component of a database are all of those executable files and configuration files for the database software itself. I mean, that's what makes it run. So, it's a critical component and if these executable or configuration files are compromised then, of course, that can affect the insertion, their retrieval, and processing of any data in the database. So, it's critically important that we can protect those executable files and those configuration files.

And then the third, and I think equally overlooked component is metadata associated with the database. So boy, what does that mean? Well, this metadata is information about the data that's in your database. So, it may be the definition of all the tables that store information, information about the users that have access to that database, the privileges that each user has, and the types of information that those users have access to. So, it even contains components, that metadata contains components that defined how information is processed in that database, such as database functions or stored procedures. So, when we talk about database integrity, it goes beyond ensuring that the proper data is stored in the database and hasn't changed. There are all these other pieces. But, ensuring to all three components are monitored for integrity is absolutely critical.

Q: Okay, great. So, how would an organization go about beginning to ensure database integrity?

A: Well, I think it would begin with creating an inventory of all of your databases and all of your database servers. And because many times there's information sprawl and we find that many times data is located in many disparate locations throughout the enterprise. And no one really has a strong handle on where that data resides. So, first, that inventory is critical, but once you've identified where your data lies, where it exists, and the databases associated with them, then it's important to go deeper and understand what are the critical components that need to be protected and then create a strategy to monitor all three of those components that I just spoke about in an efficient manner, because you know, ideally, all three of those components should be monitored on a continuous basis.

Q: In the starting process for database integrity and maintaining database security, those are two different things right? So, how can organizations ensure that they haven't been modified in any way?

A: Well, that's a pretty difficult question. I think it's a question that enterprises are constantly grappling with. So, what we've done is we've developed a database integrity monitoring tool called CimTrak, that can be used to continuously monitor the integrity of those databases. It helps companies identify exactly when a new user is added to a database, when new privileges have been granted to a user, or privileges have been altered for a user. It lets us know when new store procedures have been created or altered, configurations have been modified in some way, or even if those core executables, which drive and run that database have been altered in some way. And then when something does occur, our software goes so far as to notify the user and then provides side-by-side comparisons. So, you can have the insight to see exactly what's changed, exactly what lying to this configuration change, or exactly what piece of information has changed.

So, we think we've created this incredible way to monitor the integrity of your databases. So, I think we can help but, Hillary, to be honest, most organizations are not monitoring their databases. It's unfortunate because, as you know, that's really where most of the valuable corporate assets lie. So, let's just hope that we can see a stronger shift in the industry towards stronger database integrity.

Q: Excellent. Well, Robert, as always, thank you so much and this has been just really informative and fascinating. I'm sure our listeners will really enjoy it. Thank you.

A: Thank you, I appreciate being on your show.