Continuous database security and compliance

Patent metadata

Field	Value
Publication number	US-11003779-B2
Application number	US-202017037708-A
Country	US
Kind code	B2
Filing date	Sep 30, 2020
Priority date	Aug 22, 2018
Publication date	May 11, 2021
Grant date	May 11, 2021

Abstract

A method by a security system for selectively triggering different ones of a plurality of database assessment scans for a database and detecting when non-compliant database configurations of the database are being used. The method includes monitoring for occurrences of a first class of database operations, responsive to detecting an occurrence of one or more database operations of the first class, selecting one or more subsets of the plurality of database assessment scans to be rerun, triggering performance of only the selected one or more of the subsets, identifying one or more non-compliant database configurations of the database based on accessing results of the selected one or more of the subsets, determining one or more security rules for detecting occurrences of database operations that make use of the identified one or more non-compliant database configurations, and applying the determined one or more security rules.

First claim

What is claimed is:

1. A method by a security system implemented by one or more electronic devices for selectively triggering different ones of a plurality of database assessment scans for a database and detecting when non-compliant database configurations of the database are being used, the method comprising:
monitoring for occurrences of a first class of database operations that have been determined to require only rerunning subsets of the plurality of database assessment scans to determine whether results of the plurality of database assessment scans have changed, wherein different database operations of the first class require different subsets of the plurality of database assessment scans to be rerun to determine whether the results of the plurality of database assessment scans have changed;
responsive to detecting an occurrence of one or more database operations of the first class, selecting one or more of the subsets to be rerun based on which of the database operations of the first class occurred;
triggering performance of only the selected one or more of the subsets to determine whether the results of the plurality of database assessment scans have changed;
identifying one or more non-compliant database configurations of the database based on accessing results of the selected one or more of the subsets;
responsive to identifying the one or more non-compliant database configurations, determining one or more security rules for detecting occurrences of database operations that make use of the identified one or more non-compliant database configurations; and
applying the determined one or more security rules while monitoring accesses to the database to detect occurrences of database operations that make use of the identified one or more non-compliant database configurations.

2. The method of claim 1 , further comprising:
monitoring for occurrences of a second class of database operations that have been determined not to require rerunning of any of the plurality of database assessment scans to know that a result of at least one of the plurality of database assessment scans will be affected; and
responsive to detecting an occurrence of one or more database operation of the second class, generating an alert.

3. The method of claim 1 , wherein the triggering performance of only the selected one or more of the subsets is responsive to detecting an occurrence of a single one of the database operations of the first class.

4. The method of claim 1 , wherein the triggering performance of only the selected one or more of the subsets is responsive to detecting a threshold number of occurrences of the database operations of the first class.

5. The method of claim 1 , wherein the triggering performance of only the selected one or more of the subsets is responsive to a time period expiring.

6. The method of claim 1 , wherein the selecting including selecting one of the subsets that includes a database assessment scan from the plurality of database assessment scans that identifies non-compliant user privilege configurations responsive to detecting an occurrence of a database operation of the first class that grants a privilege to a user.

7. The method of claim 1 , wherein the selecting including selecting one of the subsets that includes a database assessment scan from the plurality of database assessment scans that identifies non-compliant user profile configurations responsive to detecting an occurrence of a database operation of the first class that creates or modifies a user profile.

8. The method of claim 1 , wherein the selecting including selecting one of the subsets that includes a database assessment scan from the plurality of database assessment scans that identifies non-compliant system parameter settings responsive to detecting an occurrence of a database operation of the first class that modifies a system parameter.

9. The method of claim 1 , wherein the selecting includes accessing a mapping of different ones of the database operations of the first class to different ones of the plurality of database assessment scans.

10. The method of claim 1 , wherein the determined one or more security rules include a security rule to generate an alert if a user of the database attempts to log in to the database using a default password if a non-compliant database configuration where the user has a default password is identified.

11. The method of claim 1 , wherein the determined one or more security rules include a security rule to generate an alert if an unauthorized database link is being accessed if a non-compliant database configuration where the unauthorized database link is exposed is identified.

12. The method of claim 1 , wherein the determined one or more security rules include a security rule to generate an alert if a user of the database uses a system privilege that was granted only via public role if a non-compliant database configuration where system privileges are granted to the public role is identified.

13. The method of claim 1 , wherein the determined one or more security rules include a security rule to generate an alert if a user of the database accesses an unauthorized system table if a non-compliant database configuration where the user is authorized to access the unauthorized system table is identified.

14. The method of claim 1 , wherein the determined one or more security rules include a security rule to block database operations that make use of a non-compliant database configuration.

15. A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more computing devices, causes the one or more computing devices to perform operations for selectively triggering different ones of a plurality of database assessment scans for a database and detecting when non-compliant database configurations of the database are being used, the operations comprising:
monitoring for occurrences of a first class of database operations that have been determined to require only rerunning subsets of the plurality of database assessment scans to determine whether results of the plurality of database assessment scans have changed, wherein different database operations of the first class require different subsets of the plurality of database assessment scans to be rerun to determine whether the results of the plurality of database assessment scans have changed;
responsive to detecting an occurrence of one or more database operations of the first class, selecting one or more of the subsets to be rerun based on which of the database operations of the first class occurred;
triggering performance of only the selected one or more of the subsets to determine whether the results of the plurality of database assessment scans have changed;
identifying one or more non-compliant database configurations of the database based on accessing results of the selected one or more of the subsets;
responsive to identifying the one or more non-compliant database configurations, determining one or more security rules for detecting occurrences of database operations that make use of the identified one or more non-compliant database configurations; and
applying the determined one or more security rules while monitoring accesses to the database to detect occurrences of database operations that make use of the identified one or more non-compliant database configurations.

16. The set of one or more non-transitory computer readable storage media of claim 15 , wherein the instructions, when executed by the one or more processors, causes the one or more c

Assignees

• Imperva Inc

Inventors

• Reich Avidan
• Shulman Amichai
• Cherny Michael

Classifications

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F16/217

  Database tuning (G06F16/2282 takes precedence; database performance monitoring G06F11/3409) · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/033

  Test or assess software · CPC title