Continuous database security and compliance

Patent metadata

Field	Value
Publication number	US-10824730-B2
Application number	US-201816109465-A
Country	US
Kind code	B2
Filing date	Aug 22, 2018
Priority date	Aug 22, 2018
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

A method implemented by a security system for selectively triggering different ones of a plurality of database assessment scans for a database The method includes monitoring for occurrences of a first class of database operations that have been determined to require only rerunning subsets of the plurality of database assessment scans to determine whether results of the plurality of database assessment scan shave changed, responsive to detecting an occurrence of one or more database operations of the first class, selecting one or more of the subsets to be rerun based on which of the database operations of the first class occurred, and triggering performance of only the selected one or more of the subsets to determine whether the results of the plurality of database assessment scans have changed.

First claim

What is claimed is:

1. A method by a security system implemented by one or more electronic devices for selectively triggering different ones of a plurality database assessment scans for a database, the method comprising:
monitoring for occurrences of a first class of database operations that have been determined to require only rerunning subsets of the plurality of database assessment scans to determine whether results of the plurality of database assessment scans have changed, wherein different database operations of the first class require different subsets of the plurality of database assessment scans to be rerun to determine whether the results of the plurality of database assessment scans have changed;
responsive to detecting an occurrence of one or more database operations of the first class, selecting one or more of the subsets to be rerun based on which of the database operations of the first class occurred; and
triggering performance of only the selected one or more of the subsets to determine whether the results of the plurality of database assessment scans have changed.

2. The method of claim 1 , further comprising:
monitoring for occurrences of a second class of database operations that have been determined not to require rerunning of any of the plurality of database assessment scans to know that a result of at least one of the plurality of database assessment scans will be affected; and
responsive to detecting an occurrence of one or more database operation of the second class, generating an alert.

3. The method of claim 1 , wherein the triggering performance of only the selected one or more of the subsets is responsive to detecting an occurrence of a single one of the database operations of the first class.

4. The method of claim 1 , wherein the triggering performance of only the selected one or more of the subsets is responsive to detecting a threshold number of occurrences of the database operations of the first class.

5. The method of claim 1 , wherein the triggering performance of only the selected one or more of the subsets is responsive to a time period expiring.

6. The method of claim 1 , wherein the selecting including selecting one of the subsets that includes a database assessment scan from the plurality of database assessment scans that identifies non-compliant user privilege configurations responsive to detecting an occurrence of a database operation of the first class that grants a privilege to a user.

7. The method of claim 1 , wherein the selecting including selecting one of the subsets that includes a database assessment scan from the plurality of database assessment scans that identifies non-compliant user profile configurations responsive to detecting an occurrence of a database operation of the first class that creates or modifies a user profile.

8. The method of claim 1 , wherein the selecting including selecting one of the subsets that includes a database assessment scan from the plurality of database assessment scans that identifies non-compliant system parameter settings responsive to detecting an occurrence of a database operation of the first class that modifies a system parameter.

9. The method of claim 1 , wherein the selecting includes accessing a mapping of different ones of the database operations of the first class to different ones of the plurality of database assessment scans.

10. A method by a security system implemented by one or more electronic devices for detecting when non-compliant database configurations of a database are being used, the method comprising:
identifying one or more non-compliant database configurations of the database based on accessing results of one or more database assessment scans performed on the database;
responsive to identifying the one or more non-compliant database configurations, determining one or more security rules for detecting occurrences of database operations that make use of the identified one or more non-compliant database configurations; and
applying the determined one or more security rules while monitoring accesses to the database to detect occurrences of database operations that make use of the identified one or more non-compliant database configurations.

11. The method of claim 10 , wherein the determined one or more security rules include a security rule to generate an alert if a user of the database attempts to log in to the database using a default password if a non-compliant database configuration where the user has a default password is identified.

12. The method of claim 10 , wherein the determined one or more security rules include a security rule to generate an alert if an unauthorized database link is being accessed if a non-compliant database configuration where the unauthorized database link is exposed is identified.

13. The method of claim 10 , wherein the determined one or more security rules include a security rule to generate an alert if a user of the database uses a system privilege that was granted only via public role if a non-compliant database configuration where system privileges are granted to the public role is identified.

14. The method of claim 10 , wherein the determined one or more security rules include a security rule to generate an alert if a user of the database accesses an unauthorized system table if a non-compliant database configuration where the user is authorized to access the unauthorized system table is identified.

15. The method of claim 10 , wherein the determined one or more security rules include a security rule to block database operations that make use of a non-compliant database configuration.

16. A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform operations for selectively triggering different ones of a plurality database assessment scans for a database, the operations comprising:
monitoring for occurrences of a first class of database operations that have been determined to require only rerunning subsets of the plurality of database assessment scans to determine whether results of the plurality of database assessment scans have changed, wherein different database operations of the first class require different subsets of the plurality of database assessment scans to be rerun to determine whether the results of the plurality of database assessment scans have changed;
responsive to detecting an occurrence of one or more database operations of the first class, selecting one or more of the subsets to be rerun based on which of the database operations of the first class occurred; and
triggering performance of only the selected one or more of the subsets to determine whether the results of the plurality of database assessment scans have changed.

17. The set of one or more non-transitory computer readable storage media of claim 16 , wherein the instructions, when executed by the one or more processors, cause the one or more computing devices to perform further operations comprising:
monitoring for occurrences of a second class of database operations that have been determined not to require rerunning of any of the plurality of database assessment scans to know that a result of at least one of the plurality of database assessment scans will be affected; and
responsive to detecting an occurrence of one or more database operation of the second class, generating an alert.

18. A set of one or more non-transitory computer readable storage media storing instructions

Assignees

• Imperva Inc

Inventors

• Reich Avidan
• Shulman Amichai
• Cherny Michael

Classifications

• G06F16/217

  Database tuning (G06F16/2282 takes precedence; database performance monitoring G06F11/3409) · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/033

  Test or assess software · CPC title