POC - tests_list

《POC - tests_list》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

----------专业最好文档，专业为你服务，急你所急，供你所需-------------文档下载最佳的地方ConductingaSuccessfulDAMTechnologyEvaluation(AdditionalTests)OVERVIEWThiscollectionoftestshasbeenassembledfromnumerousduediligencetechnologyevaluationsfordatabaseactivitymonitoringprojects.Mostorganizationsselectaprojectscopethatreflectsthedesiredprotectionlevel–privilegedusermonitoring,sensitiveobjectauditing,orcomprehensive–andadjustthesetestparametersaccordingly.Thislistprovidesinsighttosomeofthetechnicalcomplexitiesofmonitoringdatabasetraffic–localversusnetwork,contextandcontentawareness–thatcandramaticallyimpactaproductionimplementation.Whilesometechnologiescantestverywell,thesetestswillprovideresultstosimulateactualperformanceandease-of-useinproductionenvironments.IfyourequireSQLtestscriptstoperformanyofthesetests,pleasecontactusdirectly.SCOPEThedevelopmentanddocumentationofmutuallyagreed-uponsuccesscriteriaiscriticaltomeasuringtheeffectivenessofthetechnology.Thisallowsbothorganizationstoassignresourcesanddrivetowardacommongoal.Sincediversetechnologiescancollect,processandsecureinformationrelatedtodatabaseactivitymonitoringdifferently,itisimportanttodocumentanticipatedtestsandusethetestplanasafoundationfortheevaluation.Aftertheconclusionofthetests,wecanreviewtheresultsanddiscussthefindingswithyou.Astherearemanyconfigurationoptions,subtlechangesinconfigurationmayyieldimprovedtestresults.ACTIVITIES1.Specifydatesandtimestoperformatest(monitoringperiod)2.Defineanddocumentsuccesscriteria3.ReturnDatabaseInventorySpreadsheet4.Receiveapplianceon-site5.Trainedpersonnelinstallsapplianceandverifiesinitialdatacollection6.Createormodifyreportsandviewsrequiredbyspecifiedsuccesscriteria7.Performtestsaccordingtotestplan8.Presentfindingstoclientmanagementteam9.Documenttestfindingsandidentifyanycriteriathatwasnotmet10.DisconnectandreturnapplianceTESTSKEYFUNCTIONALITYPURPOSERESULT(DATECOMPLETED)1.Monitorandreportondatamanipulationlanguage(DML)commands.Toensureprivilegedusersdonotcompromisedataintegrity2.Captureandreportondatadefinitionlanguage(DDL)commands.Toensureend-usersdonotchangeschemasorstructuralintegrity3.CaptureandreportonSELECTstatementsonsensitivedata.Tomonitoralldatabeingviewedbyusersandadministrators4.ReportondetailedSQL,includingthesourceoftherequest,theactualSQLcommands,thedatabaseusername,whentherequestwassentandwhatdatabaseobjectsthecommandwasissuedagainst.Todocumentfine-grainedelementsandsupportcontrolsarounddataaccess5.Createcustomreportsandorganizeonapersonalizedportalview.Tosupportease-of-useforoperationalcontrol----------专业最好文档，专业为你服务，急你所急，供你所需-------------文档下载最佳的地方

1----------专业最好文档，专业为你服务，急你所急，供你所需-------------文档下载最佳的地方1.Groupobjects(sensitiveandfinancial)andactivitiesforuseinreporting,policies,andreal-timealerts.Tosimplifyon-goingmaintenanceandlowercostofownership2.Discover,document,captureandreportaccesstosensitiveobjects(ex:personalidentificationnumbers).Toautomatedatadiscovery,classificationandlocatesensitivedata3.Alertreal-timeonspecificexecutionofaSQLcommand(SELECT).Tosupportgranularaccesscontrolswithpolicyflexibility4.Reportondatabaseaccessincludinglogins,clientIP,serverIPandsourceprograminformation.Toprovidevisibilityforauthorizedusers,access,andprogramusage5.Performbackupofauditdata,configurationalone,andencrypt.Todemonstrateflexibilityandcompletenessingettingdataoutofthetechnology6.Verifylocaldatabasesactivityismonitored(withoutchangingdatabaseconfigurationfiles)onSharedMemoryforDB2onAIX,SQLServerconnectionsusingNamedPipeon32bitand64bitmachines,SQLServerconnectionsusingsharedmemoryon32bitand64bitmachines,OracleBequeathonHP-UX,OracleBequeathonAIX,OracleBequeathonSolariszones,OracleIPConHPUX,OracleIPConAIX,OracleIPConSolaris.ToensureDBandOScoveragemeetsenterpriserequirements7.Trackandreportonpolicyviolationsandgroupbyexceptiontype.Todocumenterrorcodes,regulatoryclassifications,andgainunderstandingonexceptions8.Performauditsonaspecificuserandreviewallcommandsexecuted.Tomonitorspecificprivilegeduserswhileignoringapplicationtraffic9.Defineanauditreviewprocess,selectingagroupofthreereportsandsendviaemailforreviewandsignoff.Toautomate,simplify,andreducecostsassociatedwiththereportingandsignoffprocess10.Trackexecutionofstoredprocedures,includingwhoexecutedaprocedure,whatprocedurenameandwhen.Togaininsightintodatabaseactivity11.Trackanytransactionsusinglinkedserver,includingwhoexecutedthetransaction,whathasbeenrecordedandwhen.Togaininsightintodatabaseactivity12.TrackandalertonadministrativecommandssuchasGRANT,REVOKE,DBCC,BACKUP,RESTORE,KILL,aswellasallactivityonalladministrativeobjects.Toisolateadministrativerolestoauthorizedindividuals13.Trackandreportallfaileddatabaselogins.Toactasanearly-warningsystemtoSQLinjectionandundesiredaccess14.ReviewallSQLexceptions,includingallfailedSQLcommands.Tobetteroptimizedatabaseinfrastructure15.Createspecificrulesonobservedevents,sendingSMTPalertswhentherulesareviolated.Toensurefine-grainedcontrolandflexibilityoverdefiningrulecharacteristics16.AlertonCREATETABLE.ToensurenonadministrativerolescannotperformDDL17.Alerton3failedlogonswithin5minutes.Tosetthresholdsandaggregatedinformationforreal-timealerts18.Captureandreportonnon-administratorsexecutingDDL.Toidentifyundesiredactivities19.Captureandreportondirectserver(non-network)loginandassociatedactivitiesbyanyadmintyperole.Toensureallactivityincludinglocalismonitored----------专业最好文档，专业为你服务，急你所急，供你所需-------------文档下载最佳的地方

2----------专业最好文档，专业为你服务，急你所急，供你所需-------------文档下载最佳的地方1.Buildaninteractivegraphicalrepresentationofdatabaseaccessactivity.Toshowauditdatainapictorialformatforeaseofreview2.Set-upautomaticscheduleddataexportandarchivingtolong-termstorage.Toreduceongoingmaintenanceintervention3.Setupdatapurgingschedule.Toreducetimecostsofoperation4.AllowdrilldownintotheactualSQLbeingexecutedbyusersonanyofthedatabasesbeingmonitored.Toprovideimmediatedetailstospecificroleson-demand5.Allowstatisticalalertbasedonconditionsregardingdatabaseaccess(usingBooleanlogictodefineconditions).Toprovidereal-timeanalyticsondatabaseauditinformation6.ProduceareportcardonsecuritypracticessuchasexcessiveSQLerrorsgenerated,excessiveloginfailuresandclientsexecutingadmincommands.Toreviewintegratedfunctionalityofthetechnology7.Exportreportsreal-timeandinbatchtoExcelforfurtheranalysisorpresentationoptions.Toprovideflexibilityforuserstoconsumedatainafamiliarway8.Selectivelyaliastechnicalinformationforlesstechnicalaudiences.Tomaketechnicalreportseasiertoreadtonon-technicalstaff9.ConfigureautomaticDNSlookuptotranslateIPaddressesintomorereadilyidentifiableinformation.Toautomatetranslationwithbusinessdetails10.Trackcommentsinreportssenttousersanddisplaycommentsfrompreviousreviewers.Tosupportautomatedauditprocess11.Escalate,comment,andtrackareporttoanotherpersonfordetailedreview.Tosupportautomatedauditprocess12.PreventusersfromaccessingsensitivedatabykillingsessionpriortocommandexecutionorbasedonreturneddatafromSQLquery.Tosecureenterprisedataandpreventabreach13.VulnerabilityAssessmentforonedatabase,customvulnerabilityassessmentbasedonSQLquerytothedatabase.Toassess,secureandhardenthedatabaseenvironment14.Demonstratethatcustomdrilldownmenuschangebasedonreporttypesanduserroles.Todemonstratecontext-based,role-basedadaptationoffunctionality15.Createanauditcomplianceworkflowforthreeusersallowingforcomments,escalationandsignoff.Tosimplifyandautomatecomplianceprocess----------专业最好文档，专业为你服务，急你所急，供你所需-------------文档下载最佳的地方