Database security firm Sentrigo has added vulnerability assessment to its arsenal.
Dubbed DBscanner, the new tool includes more than 3,000 different checks for Oracle, Microsoft SQL Server, IBM DB2 and MySQL databases. According to Sentrigo, those checks run the gamut from password strength issues to possible misconfigurations in database servers.
The product also has database discovery capabilities, and can be used to locate and identify tables with restricted information such as passwords, credit card details and personally identifiable information.
“Until now, the tasks of verifying that sensitive information is being adequately protected from growing threats, and being able to demonstrate that level of security to auditors in order to meet regulatory requirements, have been primarily based on snapshots at a point in time for each specific data asset,” said Dan Sarel, vice president of products at Sentrigo, in a statement. “Hedgehog DBscanner brings a whole new approach to solving this problem at the enterprise level, simplifying the audit process and dramatically reducing the resources required for each scan.”
Where possible, the scan results from DBscanner also provide recommendations and fix scripts to address any issues that are discovered. Reports detail each database’s current version and patch level as well as any discovered vulnerabilities such as SQL injection and malicious or insecure PL/SQL and T-SQL code.
Scan results from DBscanner are integrated with the McAfee ePO dashboard, which Sentrigo said provides organizations with centralized reporting from a common interface.
“By centralizing the scanning process, and most importantly, by making vulnerability assessment part of an ongoing scheduled process, organizations now have the necessary information at any time to respond to an audit, and can be proactive in closing any security gaps,” Sarel said.
According to Sentrigo, the scanner has been architected to operate seamlessly in virtualized or cloud computing environments.
“Users are increasingly anxious about the security of their data, and especially about inappropriate patterns of access,” said Carl Olofson, an analyst at IDC, in a statement. “Many database security products rely on a fairly static network topology which is inhibiting the adoption of new IT deployment models such as virtualization and the private cloud. Having the ability to protect database data despite a virtualized environment or shifting network deployment configurations would certainly encourage such adoption, and would free enterprises to deploy databases in more flexible and useful ways, knowing their data is safe.”
DBscanner is also integrated with Hedgehog Enterprise v4.0, the latest version of Sentrigo’s database monitoring software. Both products are available now, with DBscanner supporting Oracle Version 9.1 or later; Microsoft SQL Server 2000 or later; IBM DB2 Version 8.1 or later for Linux, Unix and Windows; and MySQL Version 4.0 or later.