数据库安全准入
收藏资源简介：
帕拉迪数据库准入，对内部网络中违规接入及操作数据库服务器的威胁进行防范。对于违规接入，通过内置的网络防火墙以及准入防火墙的结合，制定严格的接入匹配规则，匹配范围从网络层到应用层，对于非法接入请求进行拒绝，大大提升了数据库服务器的接入安全性。一、产品优势数据库防火墙准入学习模型 帕拉迪数据库准入防火墙，主要架设在应用程序和数据库中间，为数据库建立起了一道坚实的屏障，通过白名单自学习进行访问准入规则的固化（自动学习数据库访问行为的五元素，通过管理者人为固化安全规则），未被固化的数据库接入行为都会进行实时的预警和阻断会话（访问源地址异常，访问源主机名称异常，数据库访问实例名称异常，访问工具名称异常，登录帐号名称异常），在不影响性能和修改数据库的情况下，通过持续跟踪所有数据库操作来识别未授权的活动或可疑的活动，并及时阻断，避免数据库遭受网络攻击，从根本上解决数据库恶意访问威胁。数据库防火墙完整会话解析 采用现今最先进的网络数据审计技术——流会话技术，保存数据流生命周期内“上下文”相关环境，进行分析解码。深度解码数据库网络数据流传输协议，完整、细粒度分析并再现用户数据库操作活动会话过程。会话内容从访问的发起、连接、到结束进行完整解析。完整解析用户数据库会话细节，包括用户数据库登录行为、登出行为、SQL操作用户名称、SQL操作的数据库实例名称、SQL操作源程序名称、SQL操作源终端名称、SQL会话参数设置、SQL操作语句、SQL操作返回状态、SQL操作涉及表组、字段、视图、索引、过程 、函数、SQL DML操作影响行数、SQL语句执行时间、原始数据库记录包等。可对包括：Oracle所有版本、Sybase所有版本、SQL Server所有版本、Informix所有版本、DB2所有版本、MySQL所有版本进行完美会话解析。超长SQL语句分析与控制 数据库准入防火墙系统基于流会话技术进行全状态、全协议解码，能完整的、细粒度的解析超长及超级SQL语句。通过对超长及超级SQL语句的完全解析与分析，监控了恶意攻击者试想通过逃避审计对数据库造成非法操作的途径，为安全事件的追溯提供了强有力的证据；同时也为实际业务中SQL语句的全面控制提供了保障。二、客户收益在数据库响应前去除非法链接或扫描，最大化降低被攻击的频率；在不影响性能和修改数据库的情况下，通过持续跟踪所有数据库操作来识别未授权的活动或可疑的活动，并及时阻断，避免数据库遭受网络攻击；增进用户对数据库安全管理的便捷性，还能提升用户的风险管控和法规遵从能力；保障企业业务系统数据的安全性和完整性；在数据库外围搭设一道防线，将数据库的安全问题实现“御敌于国门之外，为企业机构业务安全撑起保护伞。
Paladi Database Access Control prevents threats of unauthorized access to and malicious operations on database servers within the internal network. For unauthorized access, it combines built-in network firewalls and admission firewalls to formulate strict access matching rules ranging from the network layer to the application layer, rejecting illegal access requests and greatly improving the access security of database servers. ### 1. Product Advantages #### 1.1 Database Firewall Admission Learning Model Paladi Database Access Control Firewall is mainly deployed between applications and databases, establishing a solid barrier for databases. It consolidates access admission rules through whitelist self-learning (automatically learning the five elements of database access behavior and having administrators manually consolidate security rules). All unconsolidated database access behaviors will trigger real-time alerts and session blocking (including abnormal access source address, abnormal access source host name, abnormal database access instance name, abnormal access tool name, and abnormal login account name). Without affecting performance or modifying databases, it continuously tracks all database operations to identify unauthorized or suspicious activities and block them in time, preventing databases from cyberattacks and fundamentally resolving malicious access threats to databases. #### 1.2 Complete Session Parsing of Database Firewall Adopting the most advanced network data auditing technology—flow session technology, it saves the "context" environment during the data flow lifecycle for analysis and decoding. It deeply decodes the transmission protocols of database network data flows, comprehensively and finely analyzes and reproduces the session process of user database operation activities. It fully parses session content from the initiation, connection to termination of access, including user database login and logout behaviors, SQL operation user names, database instance names for SQL operations, source program names for SQL operations, source terminal names for SQL operations, SQL session parameter settings, SQL operation statements, SQL operation return statuses, table groups, fields, views, indexes, procedures, functions involved in SQL operations, the number of rows affected by SQL DML operations, SQL statement execution time, and original database record packets. It can perfectly parse sessions for all versions of Oracle, Sybase, SQL Server, Informix, DB2, and MySQL. #### 1.3 Ultra-long SQL Statement Analysis and Control Based on flow session technology, the database admission firewall system performs full-state and full-protocol decoding, which can completely and finely parse ultra-long and super SQL statements. By fully parsing and analyzing such statements, it monitors the ways that malicious attackers attempt to perform illegal operations on databases by evading audits, providing strong evidence for the traceability of security incidents; meanwhile, it guarantees comprehensive control over SQL statements in actual business scenarios. ### 2. Customer Benefits - Block illegal links or scans before the database responds, maximally reducing the frequency of attacks; - Continuously track all database operations to identify unauthorized or suspicious activities and block them in time without affecting performance or modifying databases, preventing databases from cyberattacks; - Improve the convenience of users' database security management, and enhance users' risk management and regulatory compliance capabilities; - Guarantee the security and integrity of data in enterprise business systems; - Build a defensive line around the database, effectively blocking threats before they infiltrate the database perimeter, and creating a protective umbrella for the business security of enterprises and institutions.
