Database Security

Principal workflows

• Discover and classify: Moraph uses Imperva's discovery and classification to find the databases in scope and the tables that hold sensitive data, and agrees the list with your data owners.
• Monitor: Imperva agents or gateways capture database activity independently of the database's own logging, and audit policies record the access your policy requires, including privileged users and sensitive tables.
• Triage and respond: Moraph reviews Imperva alerts, sets aside activity explained by approved jobs or changes, and escalates the rest to your security team with the query, user, source and volume involved.
• Evidence and review: Moraph produces the reports your auditors expect, such as privileged user activity and access to sensitive data, and reviews coverage and tuning with you each month.

Who uses it

• CISOs and information security officers at banks, credit unions, broker-dealers and lenders
• Database and infrastructure teams who run the databases behind core banking and lending
• Security operations teams who investigate data access
• IT audit and compliance teams responsible for database access controls
• Institutions that own Imperva but need it tuned and operated

Reporting

• Databases monitored and coverage gaps
• Alerts by policy, outcome and escalation
• Privileged user activity on sensitive databases
• Access to sensitive tables by user and application
• Database user rights review results
• Policy and configuration changes

Features

• Independent activity capture: Imperva records database activity through its own agents or gateways, separate from the database's native logs, so administrators cannot alter the record of their own actions.
• Sensitive data discovery: Imperva scans databases for tables and columns holding customer identifiers, account numbers and similar data, and Moraph reviews the results with your data owners.
• Bulk extraction alerts: Security policies raise alerts when a user or account reads an unusually large volume from sensitive tables, or reads them from an unexpected source or at an unexpected time.
• Privileged user monitoring: Activity by database administrators and other privileged accounts is audited in full, including schema changes, permission changes and direct reads of sensitive data.
• Application profiling: Imperva learns the normal queries of known applications and service accounts, so departures from that profile can be flagged.
• Optional blocking: Where your institution chooses, Imperva can be configured to block specific activity, such as a defined query pattern from an unapproved source. Moraph enables blocking only on policies you approve.
• User rights review: Imperva reports who holds which permissions on each database, and Moraph runs periodic reviews of those rights with data owners.
• Policy tuning: Moraph adjusts audit and security policies as alerts are reviewed, so noise is reduced and each change is approved and documented.
• Alert triage: Moraph reviews alerts against approved jobs and changes and passes those needing a decision to your security team with the details attached. Automated suggestions may help sort alerts; people make the decisions.
• Coverage and health monitoring: Moraph watches agent and gateway health and reports databases that are not being monitored, for example after a server rebuild.
• Audit reporting: Scheduled reports on privileged activity, sensitive data access and policy changes, prepared for auditors and examiners.
• Change management: Every policy, agent and configuration change goes through a change request your team approves, with the result verified.

Integrations

• Databases: Imperva agents or gateways monitor the database platforms it supports, such as Oracle, Microsoft SQL Server, IBM Db2 and others, confirmed against your versions during design.
• SIEM: Alerts and selected audit events forwarded to your security information and event management system for correlation.
• Identity provider and directory: Console users sign in through your identity provider, and directory data helps attribute database activity to real people.
• IT service management: Approved changes and scheduled jobs from your service management tool are used to explain expected activity during triage.
• Privileged Access Management: Where you also use Moraph's managed CyberArk service, privileged sessions can be matched to the database activity they produced.
• Moraph service portal: Alerts, change requests, coverage and monthly service reviews tracked in Moraph's service portal, available to your team through single sign-on.

Deployment

• Agents in your environment: Imperva agents on database servers and management components in your data center or cloud account, operated by Moraph.
• Network gateways: Gateways on the network path to databases where installing agents is not possible, with the coverage trade-offs documented.
• Existing Imperva estate: If you already own Imperva, Moraph can take over operations after a baseline review of coverage and policies.

Security and privacy

• Single sign-on: Your staff sign in to the Imperva console and Moraph's service portal through your identity provider, so your password and multi-factor policies apply.
• Role-based access: Who can view audit data, change policies or see captured query values follows their role, and database administrators do not administer the monitoring of their own activity.
• Sensitive values masked: Imperva can mask sensitive values captured in queries and results, so reviewers see the activity without seeing customer data where it is not needed.
• Moraph staff access: Moraph engineers work through role-based access you approve, and cannot use keys to your data without explicit, time-bound authorization.
• Complete audit trail: Changes to Imperva policies and settings are logged, and Moraph's service portal records every change request, approval and triage decision.
• Audited operations: Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose.

Limitations

• Moraph is not Imperva. Moraph resells, implements and operates the platform; Imperva develops it and is responsible for its software and any services it hosts.
• Imperva's own service commitments, product roadmap and any outages of its services apply. Moraph does not change them.
• Licences are subject to Imperva's terms, which you accept as part of the purchase.
• Monitoring covers the databases and platforms Imperva supports and where agents or gateways are deployed. Databases outside that coverage are reported as gaps.
• Alerting detects activity as it is captured; it does not by itself stop an extraction. Blocking is available only for policies you approve and can affect legitimate activity if set too broadly.
• Moraph triages alerts but does not replace your security operations center, and does not decide whether an event is a reportable incident.
• Encrypted database connections may need additional configuration for activity to be captured, depending on the method used.
• Audit data retention is limited by the storage you provide or license.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/database-security. Purchasing routes and company information: www.moraph.com/how-to-buy.