Over 44 records are stolen per second every day due to data breaches, and according to the Risk Based Security Research report published in 2019, databases are the top most targeted assets for malicious actors to exploit organizations’ confidential data. Often, organizations don’t realize their databases have been compromised for months. Once sensitive data is leaked, the damage can’t be undone.
An organization can greatly improve its ability to detect attacks at an early stage by monitoring and analyzing logs for abnormal activity. Events such as unauthorized access attempts can help identify and prevent threats before the damage even occurs.
In the first part of this blog series on SQL Server, we’ll cover why it’s important to monitor SQL logs to secure your database.
What logs should be monitored to secure your SQL database?
Transaction logs are an integral part of SQL Server logs. These logs provide information on insert, update, and delete transactions carried out in your SQL database. Along with the transaction logs, you should also log and monitor:
- SQL Server setup logs
- SQL Server profiler logs
- SQL Server agent logs
- SQL Server error logs
These logs not only help detect data exfiltration, but also aid in troubleshooting operational failures. Maintaining an audit trail of database actions comes in handy when investigating security incidents.
There are native SQL Server tools—Extended Events, SQL Trace, SQL Profiler, Activity Monitor, Trace Flags, Database Console Commands (DBCC)—that help monitor the health of the database, and also analyze security incidents and other anomalous events. This may seem sufficient, but not quite; the information recorded becomes useful only if IT security teams are notified when malicious events occur in the database, which these tools cannot do.
How can you improve SQL auditing?
To safeguard sensitive data stored in databases, it’s essential to audit database activities in real time and correlate the information within the business context and other network activities. A powerful tool like a security information and event management (SIEM) solution can perform these functions and provide a high analytical framework that speeds up the incident detection and resolution process.
Often, a SIEM solution comes with user and entity behavior analytics (UEBA) and threat analytics features that can efficiently analyze the database logs and detect indicators of compromise such as unauthorized tables updates, data accesses, and suspicious database login attempts with great accuracy. Further, SIEM solutions also have the capability to alert administrators in real time of any untoward incidents, and execute automated workflows to quickly resolve the incident or contain an ongoing attack.
In the next blog, we’ll discuss authentication and authorization of users and activities in SQL Server. We’ll also cover database login auditing and the role it plays in keeping your SQL Server secure.
Meanwhile, are you looking for more insight on effectively auditing and securing your SQL database? Ask our experts.
