Most organizations still lack visibility into database assets

Only 19 percent of organizations have what the organization considers to be “excellent” visibility into their data and database assets, according to Osterman Research and DB Networks. This level of visibility is necessary to rapidly identify a data breach.

Furthermore, 47 percent of those surveyed do not have an assigned team or even an individual to oversee the security of their databases.

“This study reveals there’s a clear shift beginning to occur in information security away from total reliance on perimeter security toward a greater emphasis on database security,” said Michael Osterman, president of Osterman Research. “Identifying compromised database credentials and insider threats will likely receive far more investment in the future. And it is likely that the actual rate of successful infiltrations or other leakage events may be higher than discussed in this report due to inadequate organizational systems for tracking successful threats.”

Key findings

• In addition to most survey respondents lacking excellent visibility into their organizations’ data and databases, 59% of respondents lack a high degree of certainty about which applications, users and clients are accessing their databases.
• When asked what database security issues are of most concern, compromised credentials was the top concern of half of the survey respondents. The next biggest concern was the potential for the organization to experience a major data breach, followed by the inability to identify data breaches until it’s too late.
• Thirty-nine percent of organizations surveyed lack the necessary tools to allow them to identify a database breach resulting from compromised or abused credentials.
• The research also revealed that a data breach resulting from compromised or abused credentials could not be discovered quickly. Only 21 percent of survey respondents indicated they can discover such a data breach almost immediately. Most could not, and 15 percent responded they have no idea how long it would take to discover a breach.
• Thirty-eight percent of organizations surveyed revealed they do not have the mechanisms and controls in place to allow them to continuously monitor their organization’s databases in real time.
• Only 20 percent of organizations surveyed conduct database activity assessments on a more or less continuous basis. However, slightly more than half of respondents conduct these assessments very infrequently – only once per quarter or less often. And 6 percent of organizations never conduct these assessments.

“Given the large number of database breaches over the past couple of years, it’s concerning that fifty-nine percent of organizations surveyed say they lack a high degree of certainty regarding which applications, users and clients are accessing their databases. In my opinion, that should be fundamental security hygiene and a mandatory compliance requirement,” Brett Helm, Chairman and CEO of DB Networks, told Help Net Security.