Imperva specializes in data security and compliance solutions for the data center. Its product lineprovides an automated and transparent approach to protecting and controlling sensitive datathroughout transactional data systems. The Imperva database and Web application appliances aredeployed in leading financial, retail, telecommunications, healthcare and government organizations around the globe. CEO Shlomo Kramer, who founded Imperva more than five years ago, is recognized by someindustry publications as one of the 20 luminaries who changed the network industry.
On May 8, Imperva announced the SecureSphere Universal Visibility Architecture (UVA), whichmonitors all database activity regardless of the method used to access the database. TechNewsWorld discussed with Kramer this new security strategy and his view of the data security and compliance industry.
TechNewsWorld: What unique requirements must data centers meet to ensure security and compliancethat other enterprise businesses do not have?
Shlomo Kramer:
The data center is a very unique environment. It is much more complex and dynamic than othercorporate environments. Our challenge was knowing how to understand the database structure. Thatwas a very large problem because they change all the time. We have to deal with new technology.
TechNewsWorld: What are the most threatening challenges facing security at call centers and corporate networks?
Kramer:
The threat landscape has completely changed over the last two years. For instance, the bigthreats then were distributed OS attacks, hackers driven by their egos, etc. Today it [is] muchdifferent. Hackers are more sophisticated and are driven by profit. They are part of an organizedeffort to go after stolen credit cards, private information and such. Also, there is now a blackmarket on stolen information. That didn’t exist two years ago. What is also growing is a greattemptation by workers. We didn’t see an internal threat from workers seeking profit two years ago.This internal threat is a big shift in a big way.
TechNewsWorld: How has the network industry changed in recent years?
Kramer:
Data access now happens through multiple channels — the Web, local drives, developers thatallow broad privileges. We are in a unique position to control usage of data with uniquetechnology to address the threats unobtrusively. The market today is flooded with customersbuilding their own solutions. Our approach offers all these solutions in a way that no other vendorprovides.
TechNewsWorld: How does Imperva’s SecureSphere network monitoring and security gateways differ from other device solutions?
Kramer:
SecureSphere is the first network-based database security and compliance product capable ofproviding full visibility into local events initiated by privileged users and automated maintenancetasks using IPC (Inter Process Communication) mechanisms. Our product tracks all avenues in and outof a database, including direct access to the host, without requiring any changes to scripts orwork processes. This capability is vital for preventing insider abuse and meeting compliancerequirements for complete auditability of database events.
TechNewsWorld: What is the premise for how this new apparatus works that makes it suitable for regulatory security standards?
Kramer:
The SecureSphere Universal Visibility Architecture monitors all database activity regardless ofthe method used to access the database. To secure sensitive business data and document controls forregulatory compliance, organizations must be able to monitor, audit and control database access byauthorized and privileged users. It also has to handle programs running batch operations or storedprocedures. SecureSphere addresses these requirements by providing comprehensive visibility intoall database communications mechanisms, eliminating the ability of privileged users to modify auditsettings, without impacting application performance.
TechNewsWorld: What new threats are presented by Web 2.0 applications?
Kramer:
Web 2.0 introduces a number of new challenges. There is more logic on the client machine today. This makes possible threats such as the Sammy worm that uses MySpace to spread. This is capable ofuploading various forms of attack platforms. Also, there is a wide variety of new data sources fromthe Internet. We are seeing an evolutionary step for sharing of data and code. Google had a problemwith cross-site scripting and certificate forgeries, which are other examples of security breachesWeb 2.0 vulnerabilities have allowed.
TechNewsWorld: Are Web application firewalls adequate to insure protection today?
Kramer:
Firewalls are still the best method. They have evolved over the years. They still offer thebest method of protection.
TechNewsWorld: Are there new best practices that companies need to follow to fend off these newest Web 2.0 threats?
Kramer:
We see more and more companies extending their existing best practices to new Web 2.0 situations. Compliance and privacy laws are really driving security groups to expand best practices. The data center is on the front line for most companies. The ’90s security methods are replaced today with new varieties of visibility methods. There are the three main points. These include set controls, more rigid policies and rich reporting and optimizing. Security is not about infrastructure but data. It is not only about external threats but internal also. It is not about protection but visibility and control of the way data is being used. Security needs are much broader.
TechNewsWorld: Are regulators getting it right, or are there better steps they need to require?
Kramer:
Various regulations are at different levels of maturity. People have subjective interpretations. We need to standardize what these regulations really mean over the next few years.
Loading ...
